| 제목 | yangzongzhuan RuoYi 4.8.3 Privilege Escalation |
|---|
| 설명 | RuoYi 4.8.3 (commit 7995a83e04e1a88aaea5a8a7c50570dffcb145e0) has a privilege-escalation issue in role-key handling. POST /system/role/authDataScope lets an authenticated user with system:role:edit persist roleKey=common,admin on ordinary role ID 2. checkRoleAllowed only rejects roleId==1. Uniqueness compares the full string, so existing key admin does not block common,admin.
On the next login, selectRoleKeys splits roleKey on commas and UserRealm hands the tokens to Shiro. The caller then has the admin Shiro role without being bound to role ID 1 and without receiving *:*:* wildcard permissions.
A local Docker test with the bundled ry/admin123 account was denied on POST /tool/gen/createTable before the mutation (HTTP 200 HTML title RuoYi - 403). After the mutation and a fresh login, the same CREATE TABLE request returned {"msg":"操作成功","code":0}, created table cve_rolekey_poc_7995, and wrote gen_table metadata create_by=ry.
This is distinct from CVE-2024-57438 (user-role ID assignment), CVE-2025-56396 (department data scope), CVE-2026-37669 / issue 328 (deptIds/userIds mapping), issue 300 (createTable SQL filter bypass), and issue 205 (generator RCE). Proven impact is unauthorized CREATE TABLE plus generator metadata write, not arbitrary SQL or RCE.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-role-key-authorization/blob/main/security-report-ruoyi-4.8.3-role-key-authorization.md |
|---|
| 원천 | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-role-key-authorization/blob/main/security-report-ruoyi-4.8.3-role-key-authorization.md |
|---|
| 사용자 | bobtao666 (UID 100998) |
|---|
| 제출 | 2026. 09. 08. PM 08:29 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 12:57 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416601 [yangzongzhuan RuoYi 까지 4.8.3 authDataScope checkRoleAllowed roleKey 권한 상승] |
|---|
| 포인트들 | 20 |
|---|