Missing Authorization in JeecgBoot Allows Message Disclosure

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysMessageController queryById handler. This flaw allows low-privileged authenticated users to read any message push record by supplying arbitrary record IDs to the GET endpoint /sys/message/sysMessage/queryById. This can lead to unauthorized disclosure of message content and receiver addresses belonging to other users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized access to GET /sys/message/sysMessage/queryById endpoints. Monitor logs for repeated requests with arbitrary record IDs. Use tools like curl to test if low-privileged users can access other users' message records by sending GET requests with different IDs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers with low privileges to access private message content and recipient information of other users. If exploited, it may lead to data breaches, privacy violations, and unauthorized information disclosure within the affected application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can negatively impact compliance with GDPR and HIPAA by enabling unauthorized access to personal and sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Exploitation of this flaw could result in non-compliance, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.6 or later to patch the missing authorization flaw. Restrict access to the /sys/message/sysMessage/queryById endpoint by implementing proper authentication and authorization checks. Review logs for any signs of exploitation and revoke unauthorized access.

Useful 0 Not Useful 0