Missing Authorization in JeecgBoot Allows Group Member Removal

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability. Low-privileged authenticated users can remove user group members by sending a DELETE request to /sys/user/deleteUserGroupBatch. Attackers can specify any group ID and a list of user IDs to delete entries from the sys_ugroup_user table without proper permission checks or tenant validation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to /sys/user/deleteUserGroupBatch with parameters groupId and userIds. Check logs for unauthorized deletions of sys_ugroup_user entries by low-privileged users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low privileges to disrupt group memberships, potentially removing legitimate users from administrative or privileged groups. This could lead to unauthorized access, loss of administrative control, or disruption of system functionality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows low-privileged users to delete user group members without proper authorization, potentially enabling unauthorized access or data manipulation. This could violate GDPR's principles of data integrity and security (Article 5) and HIPAA's access control requirements (45 CFR § 164.312(a)(1)), as unauthorized modifications to user groups may compromise protected health information or personal data integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.6 or later. Implement strict access controls to prevent unauthorized DELETE requests. Review logs for past exploitation attempts and remove any unauthorized user group modifications.

Useful 0 Not Useful 0