Missing Authorization in JeecgBoot Allows Log Deletion

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysLogController delete handler. This flaw allows any authenticated user, even with low privileges, to delete audit log entries. Attackers can first obtain log IDs from the unprotected /sys/log/list endpoint and then delete specific sys_log records to remove evidence of their malicious activities.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized deletion of audit logs by monitoring sys_log records. Verify if any user accessed the /sys/log/list endpoint to obtain log IDs and then used the delete handler in SysLogController. Review application logs for suspicious DELETE requests to /sys/log endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to erase their activity traces in audit logs, making it harder to detect or investigate security incidents. It compromises accountability and forensic analysis, potentially enabling further undetected attacks or misuse of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with regulations like GDPR and HIPAA, which require maintaining accurate and tamper-proof audit logs for accountability and data protection. Deleting logs violates integrity requirements and may lead to non-compliance penalties or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade JeecgBoot to version 3.9.6 or later to address the missing authorization flaw. Implement strict access controls to restrict who can access the /sys/log/list endpoint and delete log entries. Enable logging of all administrative actions for audit purposes.

Useful 0 Not Useful 0