Description
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
dromara RuoYi-Vue-Plus
Default version status: unaffected
0 to ≤ 6.0.0affected
pkg:github/dromara/RuoYi-Vue-PlusReferences
- https://github.com/dromara/RuoYi-Vue-Plus/issues/60 ↗
- https://github.com/dromara/RuoYi-Vue-Plus/commit/a8b1bea7b7a4ca260172cf74fbf4ea7763092996 ↗
- https://github.com/dromara/RuoYi-Vue-Plus/blob/v6.0.0/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysUserServiceImpl.java#L555-L560 ↗
- https://github.com/dromara/RuoYi-Vue-Plus/blob/v6.0.0/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/controller/system/SysUserController.java#L352-L356 ↗
- https://hackmd.io/@hieuPenguinnn/ruoyi-vue-plus-user-list-by-dept-datascope-bypass ↗
- https://github.com/dromara/RuoYi-Vue-Plus ↗
- https://www.vulncheck.com/advisories/ruoyi-vue-plus-through-6.0.0-data-scope-bypass-via-system-user-list-dept-deptid ↗