Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue in the RuoYi 4.8.2 software, specifically at the /system/notice/add interface.

It occurs because the application improperly sanitizes user input in the notice content field. Although it uses a sanitization method (Safelist.relaxed()) that allows some common formatting tags and tries to remove dangerous elements like <script> tags and event handlers, malicious scripts can still be injected and stored.

When the stored malicious content is later rendered, the injected scripts can execute, leading to potential security risks.

Useful 0 Not Useful 0

Impact Analysis

This stored XSS vulnerability can allow attackers to inject malicious scripts into the notice content that will execute in the browsers of users who view the affected notices.

• Attackers could steal sensitive information such as session cookies or authentication tokens.
• It could lead to unauthorized actions performed on behalf of the user (session hijacking).
• It may facilitate phishing attacks or the spread of malware.
• Overall, it compromises the security and trustworthiness of the affected application.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a stored Cross-Site Scripting (XSS) issue in the /system/notice/add interface of Ruoyi 4.8.2. Detection involves testing the notice content field for improper sanitization by injecting typical XSS payloads and observing if they are executed or stored.

You can use tools like curl or browser-based testing to send payloads to the vulnerable endpoint and check the response or rendered content for script execution.

• Example curl command to test injection: curl -X POST -d 'noticeContent=<script>alert(1)</script>' http://your-ruoyi-instance/system/notice/add
• Use a web proxy or browser developer tools to inspect if the injected script is stored and executed when viewing notices.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves preventing malicious script injection by improving input sanitization on the notice content field.

Since the current sanitization uses Safelist.relaxed() which still allows some HTML tags, consider tightening the sanitization rules to disallow all script tags and event handlers.

Additionally, apply security best practices such as encoding output when rendering user input and applying Content Security Policy (CSP) headers to reduce the impact of any injected scripts.

If possible, update to a patched version of Ruoyi once available or apply any official patches addressing this issue.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the Cross Site Scripting (XSS) vulnerability in Ruoyi 4.8.2 impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0