| 标题 | yangzongzhuan RuoYi 4.8.3 Cross-Site Request Forgery / CWE-352 |
|---|
| 描述 | RuoYi 4.8.3 (commit 3b3941abeb5402297e5b4de82a30e6471c2239f3) is affected by cross-site request forgery on state-changing GET delete endpoints.
CsrfValidateFilter only validates POST. GET /system/dept/remove/{deptId} and GET /system/menu/remove/{menuId} still perform privileged deletes. Enabling csrf.enabled=true does not block a cross-site top-level GET that reuses a logged-in administrator session.
A local test with CSRF enabled returned {"msg":"操作成功","code":0} for GET without X-CSRF-Token, and sys_dept.del_flag changed from 0 to 2. The same session sending POST without a token was rejected by the CSRF filter. An unauthenticated GET redirected to /login and did not change the row.
The attacker does not need a RuoYi account. The victim must be logged in with delete permission and must open an attacker-controlled page or link. This is distinct from RuoYi issue #321, which covers CSRF being disabled by default on POST.
Advisory: https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete |
|---|
| 来源 | ⚠️ https://github.com/Bob-wentao/security-report-for-ruoyi-csrf-get-delete |
|---|
| 用户 | bobtao666 (UID 100998) |
|---|
| 提交 | 2026-09-05 19時55分 (2 月前) |
|---|
| 管理 | 2026-10-11 11時27分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 416577 [yangzongzhuan RuoYi 4.8.3 跨网站请求伪造] |
|---|
| 积分 | 20 |
|---|