JeecgBoot Missing Authorization Exposes Tenant Admin Applications

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysTenantController endpoint GET /sys/tenant/getTenantPackApplyUsers. This flaw allows any authenticated user, even with low privileges, to read tenant administrator applications by iterating the tenantId parameter. Attackers can retrieve sensitive data including usernames, real names, phone numbers, and departments for any tenant.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the GET /sys/tenant/getTenantPackApplyUsers endpoint by monitoring logs for requests with tenantId parameters. Look for repeated or unusual queries that retrieve user details like usernames, real names, phone numbers, or departments.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged attackers could exploit this to gather personal and organizational data across multiple tenants. This may lead to privacy breaches, identity theft, or targeted phishing attacks. Organizations using JeecgBoot could face unauthorized access to sensitive employee or customer information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential failure to implement proper access controls. For HIPAA, exposure of protected health information through such breaches could result in non-compliance. Organizations may face legal penalties, reputational damage, and mandatory breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Update JeecgBoot to the latest version beyond 3.9.5 to patch the missing authorization flaw. Restrict access to the vulnerable endpoint by implementing proper authentication and authorization checks. Review and audit logs for any suspicious activity related to this endpoint.

Useful 0 Not Useful 0