Insecure Direct Object Reference in JeecgBoot Allows Deletion of AI Video Records

Executive Summary

JeecgBoot through version 3.9.5 has an insecure direct object reference vulnerability. Authenticated users can delete other users' AI video generation records by providing arbitrary userId values to the DELETE /airag/video/deleteVideoRecord endpoint. Attackers can first obtain record IDs from the unprotected GET /airag/video/listByUser endpoint and then delete victims' Redis-stored video history entries one record at a time.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to /airag/video/deleteVideoRecord with arbitrary userId parameters. Check if authenticated users can delete records not belonging to them by inspecting application logs for unauthorized deletion attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with valid credentials to delete other users' AI-generated video records. If you use JeecgBoot for AI video generation, your video history could be erased without your consent. This could disrupt workflows, cause data loss, and potentially lead to privacy violations if sensitive video content is removed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized deletion of user data. GDPR requires organizations to ensure data integrity and protect against unauthorized alteration or deletion. HIPAA mandates secure handling of protected health information. Unauthorized deletion of video records may violate these requirements, potentially leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.6 or later. Implement strict access controls to ensure users can only delete their own records. Validate userId parameters in DELETE /airag/video/deleteVideoRecord to prevent arbitrary deletions.

Useful 0 Not Useful 0