Missing Authorization in JeecgBoot Allows Permission Deletion

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysDepartPermissionController delete handler. This flaw allows low-privileged authenticated users to delete department permission bindings by exploiting unguarded list endpoints to obtain row IDs and sending DELETE requests with the id parameter, potentially removing menus or buttons that departments grant to their roles.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized DELETE requests targeting the SysDepartPermissionController endpoint. Monitor logs for requests with the id parameter being manipulated by low-privileged users. Verify if unguarded list endpoints expose row IDs that could be used in such attacks.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could delete critical department permissions, leading to unauthorized access changes, loss of functionality for departments, or disruption of role-based access controls. This could result in system instability or privilege escalation if menus or buttons controlling access are removed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure if permissions are improperly modified, potentially violating GDPR's data protection requirements or HIPAA's access control mandates. Compliance may be impacted if the flaw enables unauthorized changes to role-based access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade JeecgBoot to version 3.9.5 or later. Implement proper authorization checks on all endpoints, especially SysDepartPermissionController. Restrict DELETE request permissions to high-privileged users only. Audit and remove unnecessary department permission bindings.

Useful 0 Not Useful 0