JeecgBoot Missing Authorization Exposes User Role Codes

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SystemApiController's getRolesByUserId handler. This flaw allows authenticated users to retrieve role codes for any user by supplying arbitrary userId values to the GET /sys/api/getRolesByUserId endpoint. Attackers with low privileges can exploit this to enumerate role assignments and identify administrator accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP GET requests to the /sys/api/getRolesByUserId endpoint. Look for requests with arbitrary userId parameters from authenticated users. Check application logs for unusual role enumeration attempts or unauthorized access patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables low-privileged attackers to gather sensitive information about user roles within the system. By identifying administrator accounts, attackers can plan further attacks such as privilege escalation or targeted phishing. It compromises the confidentiality of role assignments and undermines access control mechanisms.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and protection of sensitive user data. GDPR requires safeguarding personal data, while HIPAA mandates strict access controls for protected health information. Unauthorized role enumeration could lead to non-compliance, potential fines, and reputational damage due to data exposure risks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later. Implement strict input validation for userId parameters in the getRolesByUserId handler. Restrict access to the endpoint to authorized roles only and review all user permissions for potential abuse.

Useful 0 Not Useful 0