Missing Authorization in JeecgBoot Allows Group Membership Removal

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysUserController. Low-privileged authenticated users can exploit this by sending DELETE requests to the deleteGroupUser handler with arbitrary groupId and userId values. This allows them to remove any user from administrator-maintained groups without proper ownership or tenant checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests targeting the /sys/user/deleteGroupUser endpoint in JeecgBoot applications. Check for requests with arbitrary groupId and userId parameters sent by low-privileged users. Review application logs for unauthorized group membership modifications.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could remove users from privileged groups, potentially gaining unauthorized access or escalating their own privileges. This could lead to unauthorized data access, system manipulation, or further exploitation of the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access or privilege escalation, which may lead to data breaches. GDPR and HIPAA require strict access controls and audit logging; such a flaw undermines these controls and could result in regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later. Implement strict input validation for groupId and userId parameters in the deleteGroupUser handler. Apply role-based access controls to restrict DELETE request permissions to authorized administrators only.

Useful 0 Not Useful 0