JeecgBoot Missing Authorization in SystemApiController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SystemApiController's queryUserRolesById handler. This flaw allows authenticated users to read any user's role codes by sending a userId to the GET endpoint /sys/api/queryUserRolesById. Low-privileged attackers can exploit this to enumerate role assignments and identify administrator accounts.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to /sys/api/queryUserRolesById by monitoring GET requests with userId parameters. Look for repeated requests to this endpoint from low-privileged accounts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with low privileges to gain unauthorized access to sensitive role information. They can identify administrator accounts, which may lead to privilege escalation attacks. Attackers could use this information to target high-value accounts for further exploitation, such as phishing or lateral movement within the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive user role data, which may include personally identifiable information or protected health information. Unauthorized access to role assignments violates data protection principles, potentially resulting in regulatory fines and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update JeecgBoot to version 3.9.5 or later. Restrict access to /sys/api/queryUserRolesById by implementing proper authorization checks. Review logs for suspicious activity targeting this endpoint.

Useful 0 Not Useful 0