Missing Authorization in JeecgBoot Lets Attackers Access Role Data Rules

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysRoleController's loadDatarule handler. This allows any authenticated user, even with low privileges, to query role data rules by sending a GET request to /sys/role/datarule/{permissionId}/{roleId}. The response includes sensitive details like rule names, columns, conditions, values, and bound rule IDs for any role.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access attempts to the endpoint GET /sys/role/datarule/{permissionId}/{roleId}. Monitor logs for unusual GET requests targeting this path with varying permissionId and roleId values.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to gather sensitive role-based access control information, potentially leading to further attacks like privilege escalation or unauthorized data access. The impact is limited to information disclosure since no data modification or deletion is possible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows low-privileged attackers to read role data rules, including rule names, columns, conditions, and values for any role. This unauthorized access could expose sensitive role-based access control (RBAC) configurations, potentially violating data protection requirements under GDPR and HIPAA by enabling unauthorized access to role permissions and associated data handling rules.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade JeecgBoot to a version later than 3.9.5 where the vulnerability is patched. If immediate upgrade is not possible, restrict access to the /sys/role/datarule endpoint via network rules or application-level access controls.

Useful 0 Not Useful 0