Description

A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T05:16:59.423Z",
  "pubdate": "2026-10-12T05:16:59.423Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in the RuoYi 4.8.3 framework. The flaw resides within an unspecified component of the application, allowing remote attackers to induce authenticated users to perform unauthorized actions without their consent.\nThe vulnerability occurs due to the absence of adequate anti-CSRF token validation or equivalent state-changing request protection mechanisms. By tricking a legitimate user into executing a malicious request, an attacker can manipulate application state or perform sensitive operations under the guise of the authenticated session.\nThe risk is significant because the attack can be executed remotely, requiring only that an authenticated user visits an attacker-controlled site while their session with the vulnerable RuoYi instance is active. This does not require the attacker to bypass authentication directly, but rather leverages the existing session of the user. Consequently, the integrity of the application is at risk, as unauthorized administrative or configuration changes could be processed by the server without explicit user intent.\nVendor outreach regarding this disclosure has yielded no response, leaving implementations currently exposed to exploitation.",
  "technicalDetails": "The vulnerability is identified as a Cross-Site Request Forgery (CSRF) originating from the failure of the RuoYi 4.8.3 framework to enforce strict state-changing request validation. In web applications, CSRF occurs when a server relies solely on session cookies for authentication, failing to verify the origin or intent of the request via unique, per-request, or per-session anti-CSRF tokens.\nThe exploitation flow begins with an attacker hosting a malicious web resource or injecting a payload into a third-party site accessible to the victim. This payload consists of a crafted HTTP request (e.g., a hidden HTML form or a background fetch/XHR request) targeting an administrative or sensitive function within the RuoYi 4.8.3 interface. Because web browsers automatically include ambient credentials, such as session cookies, in requests sent to the associated domain, the RuoYi server processes the forged request as a legitimate instruction from the authenticated user.\nSince the affected function lacks proper verification controls, such as checking for a non-predictable anti-CSRF token or validating the 'Origin' and 'Referer' headers, the application proceeds to execute the requested operation. The attack is effective regardless of the user's privilege level; if an administrator is targeted, the impact is elevated to potential full system compromise, including account modification, privilege escalation, or modification of security configurations.\nThe attack vector is purely remote, requiring no direct interaction with the server's backend from the attacker's perspective, beyond the initial preparation of the trigger. Because the vulnerability lies within the framework's core request processing logic rather than a specific documented file path, the exposure surface is broad, potentially affecting any state-changing function (e.g., POST/PUT/DELETE methods) within the application that does not implement custom protective headers or tokens. The post-exploitation impact includes the loss of data integrity, unauthorized service configuration, and the potential for persistent administrative backdoors if the target function supports persistent modifications to the system state. Without specific vendor-provided patches, the default configuration of RuoYi 4.8.3 remains inherently vulnerable to these orchestrated requests as long as the user maintains an active session."
}