JeecgBoot Missing Authorization in AiragExtDataController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the AiragExtDataController exportXls handler. This flaw allows any authenticated user, even with low privileges, to export AI evaluator data by requesting /airag/extData/exportXls. The system exports every user's airag_ext_data evaluator definitions and test-tracking records as an Excel workbook without proper access controls.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to /airag/extData/exportXls endpoint. Monitor logs for repeated requests to this path by authenticated users. Verify if Excel files containing user data are being downloaded unexpectedly.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal sensitive AI evaluator data and test-tracking records from all users. This may include proprietary AI models, evaluation criteria, or user-specific performance data. The impact includes data breaches, loss of intellectual property, and potential reputational damage if the exposed data is sensitive or confidential.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and sensitive data without authorization. GDPR requires strict access controls for personal data, while HIPAA mandates protection of health-related information. A breach could lead to regulatory fines, legal liabilities, and mandatory breach notifications under these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Update JeecgBoot to version 3.9.5 or later. Restrict access to the /airag/extData/exportXls endpoint by implementing proper authorization checks. Review and audit user permissions to ensure least privilege access.

Useful 0 Not Useful 0