JeecgBoot Missing Authorization Exposes Database Credentials

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint. This endpoint lacks proper Shiro permission or role annotations, allowing any authenticated low-privileged user to retrieve sensitive database information by supplying datasource codes in the dbSourceCode parameter. The exposed data includes JDBC URLs, usernames, and decrypted cleartext database passwords.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the endpoint /sys/api/getDynamicDbSourceByCode is accessible without proper authorization. Use tools like curl to send a GET request with a test dbSourceCode parameter. Example: curl -X GET 'http://<target>/sys/api/getDynamicDbSourceByCode?dbSourceCode=test'

Inspect network traffic for unauthorized access to this endpoint. Review application logs for suspicious requests to /sys/api/getDynamicDbSourceByCode with varying dbSourceCode values.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could exploit this vulnerability to gain access to sensitive database credentials and connection details. This could lead to unauthorized data access, data breaches, or further attacks on the database infrastructure. The impact includes potential exposure of sensitive information and compromise of database integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other data protection regulations due to unauthorized access to sensitive data. It may result in data breaches, loss of personal or health information, and failure to meet regulatory requirements for data security and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later to address the missing authorization flaw. Ensure proper Shiro permission or role annotations are applied to the /sys/api/getDynamicDbSourceByCode endpoint.

Restrict access to the vulnerable endpoint by implementing authentication and authorization checks. Audit all database credentials and rotate them if they may have been exposed.

Useful 0 Not Useful 0