Missing Authorization in JeecgBoot SysCategoryController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysCategoryController. This allows any authenticated user to edit category dictionary nodes via the /sys/category/edit endpoint. Attackers with low privileges can send POST or PUT requests with a node ID to rename, recode, or move system-wide sys_category nodes, which alters classification values used across forms.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST or PUT requests to /sys/category/edit. Check application logs for unauthorized edits to sys_category nodes by low-privileged users. Use tools like Wireshark or tcpdump to capture and analyze HTTP requests targeting this endpoint.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged attackers could modify system category nodes, potentially disrupting data classification, mislabeling information, or causing inconsistencies in forms and workflows. This could lead to data integrity issues or unauthorized changes in how data is organized and accessed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to data classification structures. For GDPR, it may affect data categorization and access controls. For HIPAA, it could compromise the integrity of protected health information classifications. Both standards require proper data handling and access controls, which this flaw undermines.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.6 or later to patch the missing authorization flaw. Restrict access to /sys/category/edit by implementing proper authentication and authorization checks. Review and audit sys_category nodes for unauthorized changes.

Useful 0 Not Useful 0