| Title | yangzongzhuan RuoYi 4.8.3 Cross-Site Request Forgery / CWE-352 |
|---|
| Description | RuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by cross-site request forgery on state-changing GET delete endpoints.
CsrfValidateFilter only validates POST. GET /system/dept/remove/{deptId} and GET /system/menu/remove/{menuId} still perform privileged deletes. Enabling csrf.enabled=true does not block a cross-site top-level GET that reuses a logged-in administrator session.
A local test with CSRF enabled returned {"msg":"操作成功","code":0} for GET without X-CSRF-Token, and sys_dept.del_flag changed from 0 to 2. The same session sending POST without a token was rejected by the CSRF filter. An unauthenticated GET redirected to /login and did not change the row.
The attacker does not need a RuoYi account. The victim must be logged in with delete permission and must open an attacker-controlled page or link. This is distinct from RuoYi issue #321, which covers CSRF being disabled by default on POST.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete |
|---|
| Source | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete |
|---|
| User | bobtao666 (UID 100998) |
|---|
| Submission | 09/05/2026 19:55 (2 months ago) |
|---|
| Moderation | 10/11/2026 11:27 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416577 [yangzongzhuan RuoYi 4.8.3 cross-site request forgery] |
|---|
| Points | 20 |
|---|