JeecgBoot Missing Authorization in SysDepartRoleController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysDepartRoleController queryById handler. This means the handler does not have proper Shiro permission annotations to restrict access. Low-privileged authenticated attackers can exploit this by sending a GET request to /sys/sysDepartRole/queryById with any id parameter to retrieve sensitive department role information including names, codes, descriptions, and audit fields.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized access to GET /sys/sysDepartRole/queryById endpoints. Monitor logs for requests with any id parameter to this path. Use tools like curl to test if the endpoint leaks department role data without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low privileges to access sensitive organizational data such as department role names, codes, descriptions, and audit information. This could lead to unauthorized information disclosure, potential data breaches, and compromise of internal role structures within the affected system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows low-privileged attackers to read sensitive department role information including names, codes, and descriptions. This could lead to unauthorized access to internal data, potentially violating confidentiality requirements in GDPR and HIPAA if such data includes personal or protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply the latest patch for JeecgBoot 3.9.5 or later. If patching is not possible, restrict access to the /sys/sysDepartRole/queryById endpoint via network controls or web application firewall rules. Ensure Shiro permission annotations are added to enforce proper authorization checks.

Useful 0 Not Useful 0