JeecgBoot Missing Authorization in OpenAPI Registry Query

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the OpenApiController's queryPageList handler. This flaw allows any authenticated user, even with low privileges, to list OpenAPI registry definitions by querying GET /openapi/list. Attackers can access sensitive information such as virtual paths, internal origin URLs, IP whitelists, and header and parameter templates that are meant for administrators only.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the OpenAPI endpoint by monitoring GET requests to /openapi/list. Look for unusual activity from low-privileged users or unexpected data exposure in logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gather internal system details, such as internal URLs and IP whitelists, which may aid further attacks. This could lead to unauthorized access to sensitive data or systems if combined with other vulnerabilities. The impact is limited to information disclosure since no direct modification or deletion of data is possible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations if exposed data includes personal or health-related information.

Useful 0 Not Useful 0

Mitigation Strategies

Update JeecgBoot to the latest version beyond 3.9.5. Restrict access to the /openapi/list endpoint by implementing proper authorization checks. Review and audit API access logs for suspicious activity.

Useful 0 Not Useful 0