JeecgBoot Missing Authorization in SysDepartPermissionController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController. This allows any authenticated user to modify department role permissions without proper checks. Attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, which can lead to privilege escalation or revocation of other users' permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the endpoint /sys/dual/sysDepartPermission/saveDeptRolePermission is accessible without proper authorization. Use tools like curl to send a test request with low-privileged credentials and verify if permission modifications are possible. Example: curl -X POST -H 'Content-Type: application/json' -d '{"roleId":"test","permissionIds":["1"]}' http://target.com/sys/dual/sysDepartPermission/saveDeptRolePermission

Inspect network traffic for unauthorized POST requests to the saveDeptRolePermission endpoint. Monitor logs for repeated attempts to modify role permissions by low-privileged users.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged attackers can exploit this to gain higher privileges by assigning themselves or others unauthorized permissions. This could allow them to access sensitive data, perform unauthorized actions, or disrupt system operations. Organizations using JeecgBoot versions up to 3.9.5 are at risk of unauthorized privilege changes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Non-compliance may result in legal penalties, data breaches, or loss of trust. Organizations must address this to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.6 or later to patch the missing authorization flaw. If an update is not immediately available, restrict access to the /sys/dual/sysDepartPermission/saveDeptRolePermission endpoint via firewall rules or web application firewall (WAF) policies.

Review and audit all role permissions to identify any unauthorized changes. Revoke unnecessary permissions and implement strict access controls for administrative endpoints.

Useful 0 Not Useful 0