Remote Code Execution in JimuReport via Aviator Expression Injection

Executive Summary

JimuReport versions 2.3.4 and below have a vulnerability in the /jmreport/executeSelectApi endpoint where user input is passed directly to the Aviator expression engine without proper validation.

This improper handling allows attackers to inject malicious Aviator expressions through the paramValue parameter, which is executed by the expression engine.

By sending a specially crafted POST request with a payload starting with an equals sign (=), attackers can execute arbitrary code on the server, such as running system commands or performing JNDI injections.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution on the affected server, allowing attackers to run arbitrary commands.

Such an exploit can compromise the confidentiality, integrity, and availability of the system by enabling unauthorized access, data theft, or disruption of services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious POST requests to the /jmreport/executeSelectApi endpoint that include a paramValue parameter starting with an equals sign (=), which is used to trigger the vulnerable Aviator expression execution.

You can use network monitoring or web server logs to identify such requests. For example, using command-line tools like curl or wget to test the endpoint with crafted payloads can help confirm if the system is vulnerable.

• Use curl to send a test payload: curl -X POST -d 'paramValue=="calc"' http://target/jmreport/executeSelectApi
• Search web server logs for POST requests to /jmreport/executeSelectApi containing paramValue starting with '='.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /jmreport/executeSelectApi endpoint to trusted users only, such as by using network-level controls or authentication.

Additionally, avoid passing user-supplied input directly to the Aviator expression engine without proper validation or sanitization.

If possible, upgrade JimuReport to a version later than 2.3.4 where this vulnerability is fixed.

As a temporary workaround, you may implement input filtering to block paramValue inputs starting with '=' or containing suspicious Aviator expressions.

Useful 0 Not Useful 0