JeecgBoot Missing Authorization in AiragExtDataController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the AiragExtDataController delete handler. This flaw allows low-privileged authenticated users to delete AI evaluator records belonging to other users by sending DELETE requests to /airag/extData/delete with any id parameter. The system fails to perform owner or tenant checks, enabling unauthorized record deletion.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to /airag/extData/delete with any id parameter. Check application logs for unauthorized deletions of AI evaluator records. Use network traffic analysis tools to identify low-privileged users sending such requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized deletion of AI evaluator or test-tracking records, potentially causing data loss, disrupted workflows, or incorrect AI model evaluations. If you rely on JeecgBoot for managing AI-related data, attackers could manipulate or erase critical records without detection.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements such as GDPR or HIPAA by enabling unauthorized data deletion, which could compromise data integrity and user privacy. GDPR requires data integrity and accountability, while HIPAA mandates protection against unauthorized alteration or deletion of health records.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.6 or later. Implement strict access controls to restrict DELETE requests to /airag/extData/delete. Add tenant and owner validation checks in the delete handler to prevent unauthorized deletions.

Useful 0 Not Useful 0