JeecgBoot Missing Authorization in SysLogController deleteBatch

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysLogController deleteBatch handler. This flaw allows any authenticated user, even with low privileges, to delete system audit log entries by sending a DELETE request with the parameter 'ids' set to 'allclear'. This action wipes the entire sys_log table, erasing all users' audit trails.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized DELETE requests to /sysLogController/deleteBatch with the parameter ids=allclear. Inspect logs for repeated deletion attempts targeting the sys_log table.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to delete critical audit logs, removing evidence of their activities or other malicious actions. It compromises accountability, hides intrusion attempts, and may lead to undetected security breaches. Organizations relying on these logs for monitoring or compliance could face severe operational and security risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by erasing required audit logs. GDPR mandates data processing accountability and breach notification, while HIPAA requires secure audit trails for protected health information. Deleting logs may result in non-compliance, legal penalties, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade JeecgBoot to version 3.9.5 or later. Restrict access to the SysLogController endpoint via network policies or authentication controls. Review and restore affected audit logs from backups.

Useful 0 Not Useful 0