Vulnerability title: The html file can be uploaded where the avatar is uploaded, resulting in stored XSS
Product: https://github.com/yangzongzhuan/RuoYi
Affected Versions: v4.7.3(the lastest vesion)
Discovery time: 2022.5.16
Found by: solarpeng502
Exploit sence: The System allows multiple users to log in. If a user is granted user management rights, he can insert a malicious xss payload on user management page, so that all users with this permission can access and trigger an xss attack
Analysis report:
1. If you are not Chinese,please change the language into the English through Browser translation plugin such as Google.
2. After deployment, enter the background management page
5. Intercept the request package with a packet capture tool such as burp, change the file suffix to html, and change the content with xss payload such as "<script>alert(1)</script>,then pass the request,and the response shows "{"msg":"操作成功","code":0}",which means upload success
Fixes: The backend should verify the file suffix, and do not allow html file upload;or check the content in Html file that filter xss payloads.
新值
Vulnerability disclosure
Vulnerability title: The html file can be uploaded where the avatar is uploaded, resulting in stored XSS in Ruoyi cms
Product: https://github.com/yangzongzhuan/RuoYi
Affected Versions: v4.7.3(the lastest vesion)
Discovery time: 2022.5.16
Found by: solarpeng502
Exploit sence: The System allows multiple users to log in. If a user is granted user management rights, he can insert a malicious xss payload on user management page, so that all users with this permission can access and trigger an xss attack
Analysis report:
1. If you are not Chinese,please change the language into the English through Browser translation plugin such as Google.
2. After deployment, enter the background management page
5. Intercept the request package with a packet capture tool such as burp, change the file suffix to html, and change the content with xss payload such as "<script>alert(1)</script>,then pass the request,and the response shows "{"msg":"操作成功","code":0}",which means upload success
Vulnerability title: The html file can be uploaded where the avatar is uploaded, resulting in storedXSS in Ruoyicms
Product: https://github.com/yangzongzhuan/RuoYi
Affected Versions: v4.7.3(the lastest vesion)
Discovery time: 2022.5.16
Found by: solarpeng502
Exploit sence: The System allows multiple users to log in. If a user is granted user management rights, he can insert a malicious xss payload on user management page, so that all users with this permission can access and trigger an xss attack
Analysis report:
1. If you are not Chinese,please change the language into the English through Browser translation plugin such as Google.
2. After deployment, enter the background management page
5. Intercept the request package with a packet capture tool such as burp, change the file suffix to html, and change the content with xss payload such as "<script>alert(1)</script>,then pass the request,and the response shows "{"msg":"操作成功","code":0}",which means upload success
Fixes: The backend should verify the file suffix, and do not allow html file upload;or check the content in Html file that filter xss payloads.
新值
Vulnerability disclosure
Vulnerability title: The html file can be uploaded where the avatar is uploaded, and its content notbe filtered,which resulting in stored XSS in Ruoyi cms
Product: https://github.com/yangzongzhuan/RuoYi
Affected Versions: v4.7.3(the lastest vesion)
Discovery time: 2022.5.16
Found by: solarpeng502
Exploit sence: The System allows multiple users to log in. If a user is granted user management rights, he can insert a malicious xss payload on user management page, so that all users with this permission can access and trigger an xss attack
Analysis report:
1. If you are not Chinese,please change the language into the English through Browser translation plugin such as Google.
2. After deployment, enter the background management page
5. Intercept the request package with a packet capture tool such as burp, change the file suffix to html, and change the content with xss payload such as "<script>alert(1)</script>,then pass the request,and the response shows "{"msg":"操作成功","code":0}",which means upload success
