JeecgBoot Missing Authorization in AigcWordTemplateController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the AigcWordTemplateController delete handler. This flaw allows any authenticated user, even those with low privileges, to delete word templates by sending a DELETE request to /airag/word/delete with an id parameter. This can permanently remove templates from the shared library.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized DELETE requests to /airag/word/delete with an id parameter. Monitor logs for suspicious activity targeting JeecgBoot instances. Verify if low-privileged users can delete word templates.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete important word templates from the shared library, potentially causing data loss or disrupting workflows that rely on these templates. Since any authenticated user can perform this action, it increases the risk of accidental or malicious deletions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect GDPR or HIPAA compliance as it involves unauthorized deletion of templates by authenticated users rather than data breaches or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Update JeecgBoot to the latest version beyond 3.9.5. Implement strict access controls to prevent unauthorized DELETE requests. Restrict DELETE operations to authorized users only.

Useful 0 Not Useful 0