JeecgBoot Missing Authorization Exposes User Permissions

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SystemApiController's getUserPermissionSet handler. This flaw allows any authenticated user to read other users' permission codes by supplying an arbitrary userId to the GET /sys/api/getUserPermissionSet endpoint. Low-privileged attackers can exploit this to retrieve the full permission set of any account, including administrators.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized requests to the endpoint /sys/api/getUserPermissionSet with arbitrary userId parameters. Monitor logs for GET requests targeting this path from low-privileged users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows low-privileged users to escalate their access by viewing permission sets of higher-privileged accounts. Attackers could gain unauthorized access to sensitive data or functions, leading to data breaches, privilege escalation, or further system compromise. It undermines the principle of least privilege and can facilitate lateral movement within the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, triggering mandatory breach notifications and potential fines. Compliance with access control and audit logging requirements could also be compromised due to unauthorized privilege escalation.

Useful 0 Not Useful 0

Mitigation Strategies

Update JeecgBoot to version 3.9.5 or later. Implement strict input validation for userId parameters in the getUserPermissionSet handler. Restrict access to the /sys/api/getUserPermissionSet endpoint to authorized users only.

Useful 0 Not Useful 0