Missing Authorization in JeecgBoot Allows Rule Creation

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability. Low-privileged authenticated users can exploit the SysCheckRuleController importExcel handler to create validation rules. By uploading a specially crafted Excel file, attackers bypass the system:checkRule:add permission and create system-wide encoding validation rules with arbitrary regular expressions.

Useful 0 Not Useful 0

Detection Guidance

Check JeecgBoot logs for unauthorized SysCheckRuleController importExcel requests. Monitor for Excel uploads from low-privileged users. Inspect system-wide validation rules for unexpected regular expression patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this flaw to inject malicious regular expressions into validation rules. This might allow unauthorized data manipulation, bypass of input validation, or potential remote code execution depending on how the system processes these rules. The impact depends on how JeecgBoot uses these validation rules in the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security rule requirements. Organizations using affected JeecgBoot versions may fail compliance audits if exploited, risking legal penalties and data breach liabilities.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade JeecgBoot to version 3.9.5 or later. Restrict access to SysCheckRuleController endpoints. Review and remove unauthorized validation rules. Implement strict input validation for Excel uploads.

Useful 0 Not Useful 0