CVE-2024-9048 Overview
CVE-2024-9048 is a stored cross-site scripting (XSS) vulnerability in the y_project RuoYi rapid development platform through version 4.7.9. The flaw resides in the SysUserServiceImpl class located at ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java, within the Backend User Import component. Manipulation of the loginName argument during user import allows injection of attacker-controlled script content. The vulnerability is exploitable remotely without authentication, though the attack complexity is high. Public disclosure of the exploit has been made, and the maintainers have issued a patch identified by commit hash 9b68013b2af87b9c809c4637299abd929bc73510.
Critical Impact
Attackers can inject persistent JavaScript payloads through the user import feature, executing arbitrary script code in the browsers of administrators viewing the RuoYi backend.
Affected Products
- RuoYi (y_project) versions up to and including 4.7.9
- Component: Backend User Import (SysUserServiceImpl)
- File path: ruoyi-system/src/main/java/com/ruoyi/system/service/impl/SysUserServiceImpl.java
Discovery Timeline
- 2024-09-21 - CVE-2024-9048 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9048
Vulnerability Analysis
RuoYi is a Java-based rapid development platform widely deployed for enterprise back-office applications. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). The SysUserServiceImpl service processes bulk user imports and stores the loginName field without sufficient output encoding. When an administrator later views the imported user records, the browser renders the injected payload in the DOM context of the backend management console.
Because the payload persists in the database, any subsequent viewer of the affected records triggers execution. Successful exploitation enables session token theft, backend action forgery, and pivoting into administrative functionality accessible to the victim.
Root Cause
The root cause is missing input sanitization and output encoding on the loginName argument within the user import workflow. The application accepts imported values verbatim and later reflects them into administrative views without HTML entity escaping or contextual filtering.
Attack Vector
An attacker crafts a user import file (typically an Excel or CSV payload accepted by the import endpoint) containing a malicious loginName value with embedded HTML or JavaScript. Once imported, the payload is stored server-side. When an administrator opens the user list or detail view, the script executes with the administrator's session context. The high attack complexity reflects the requirement to reach the import functionality and induce an administrator to view the poisoned record.
No verified public exploit code is available. Refer to the Gitee Issue Discussion for technical context.
Detection Methods for CVE-2024-9048
Indicators of Compromise
- User records containing HTML tags, <script> elements, or JavaScript event handlers within the loginName field.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting the user management page.
- Anomalous session activity or privilege changes following a bulk user import operation.
Detection Strategies
- Review the RuoYi sys_user database table for login_name values containing angle brackets, quotes, or script keywords.
- Inspect web server access logs for POST requests to the user import endpoint originating from unauthenticated or unusual sources.
- Correlate imported user creation events with subsequent XHR or fetch requests initiated from administrator sessions.
Monitoring Recommendations
- Deploy Content Security Policy (CSP) reporting to capture inline script violations in the RuoYi administrative interface.
- Enable audit logging on the user import workflow and alert on imports containing non-alphanumeric characters in identity fields.
- Monitor administrator session traffic for cookie exfiltration patterns or unexpected cross-origin requests.
How to Mitigate CVE-2024-9048
Immediate Actions Required
- Apply the upstream patch identified by commit 9b68013b2af87b9c809c4637299abd929bc73510 from the RuoYi Gitee repository.
- Audit existing user records for injected content in the loginName field and sanitize or delete affected entries.
- Restrict access to the Backend User Import functionality to trusted administrators only.
Patch Information
The RuoYi maintainers addressed the vulnerability in commit 9b68013b2af87b9c809c4637299abd929bc73510. Operators running versions up to 4.7.9 should upgrade to a build incorporating this fix. Full details are published in the Gitee Commit Log and referenced in VulDB #278215 Details.
Workarounds
- Enforce server-side validation on the loginName field to reject non-alphanumeric characters prior to persistence.
- Apply HTML entity encoding to all user-controlled fields rendered in backend administrative views.
- Deploy a Web Application Firewall (WAF) rule to block import payloads containing HTML tags or script constructs.
- Configure a restrictive Content Security Policy that disallows inline script execution in the RuoYi console.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
