JeecgBoot Missing Authorization in Department Permission Binding

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability. Low-privileged authenticated users can exploit this by sending a POST request to /sys/sysDepartPermission/add to create unauthorized department permission bindings. Attackers can manipulate departId, permissionId, and dataRuleIds fields to grant menu, button, and data rule permissions to any department, which can then be delegated to roles.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /sys/sysDepartPermission/add with low-privileged authenticated users submitting arbitrary departId, permissionId, and dataRuleIds fields. Check application logs for unauthorized permission binding attempts or unusual department-role mappings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low privileges to escalate their access by assigning unauthorized permissions to departments and roles. This could lead to unauthorized data access, privilege escalation, or control over system functions, potentially compromising the entire application or sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, violating data integrity, or failing to enforce proper access controls. GDPR requires strict access controls and data protection, while HIPAA mandates role-based access and audit controls. Exploitation could lead to non-compliance and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later. Review and revoke any unauthorized permission bindings created via this vulnerability. Implement strict input validation for POST /sys/sysDepartPermission/add requests and enforce role-based access controls.

Useful 0 Not Useful 0