Missing Authorization in JeecgBoot Allows Permission Deletion

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability. Low-privileged authenticated users can delete department permission bindings by exploiting the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can first obtain row IDs from an unprotected list endpoint and then submit these IDs in the ids parameter to remove menus and buttons that departments grant to their roles.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized DELETE requests to the /sys/sysDepartPermission/deleteBatch endpoint. Monitor logs for repeated or unusual deletion attempts targeting department permissions. Verify if low-privileged users can access the DELETE endpoint or retrieve row IDs from unguarded list endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low privileges to remove critical permissions from departments. This could lead to unauthorized access to sensitive data, disruption of system functionality, or unauthorized modifications to system configurations. Organizations using JeecgBoot may face data breaches, operational disruptions, or compliance violations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, violating GDPR's data protection principles or HIPAA's security requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised data integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later. Restrict access to the /sys/sysDepartPermission/deleteBatch endpoint to authorized users only. Review and audit all permission bindings to identify unauthorized deletions. Implement strict input validation for the ids parameter in DELETE requests.

Useful 0 Not Useful 0