They are both right.
However, the meanings are different, and that’s why they are both correct.
“Who she is” describes precisely that - who she is.
eg. Cruel is a good word to tell you who she is.
“Who is she” is used as a question to find out more about her.
eg. “I’ve seen that woman somewhere before. Who is she?”
Sandy is amazing, that is just who she is, she can get anyone to buy a car.
Who is she? The girl in the pink dress.
He is such a nice guy all the time, is that just who he is?
Is that the man you like, who is he?