JeecgBoot Missing Authorization Exposes Tenant Records

Executive Summary

This vulnerability in JeecgBoot through version 3.9.5 is a missing authorization issue in the SysTenantController queryTenantAuthInfo handler. It allows any authenticated user to read records belonging to other tenants by iterating small integer tenant IDs. Attackers can retrieve full sys_tenant records, including sensitive data like house numbers used as tenant join codes and company profile fields.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to sys_tenant records by monitoring API calls to /sys/tenant/queryTenantAuthInfo. Look for repeated requests with small integer tenant IDs. Use tools like curl to test if low-privileged users can retrieve other tenants' data: curl -X POST http://<target>/sys/tenant/queryTenantAuthInfo -d 'tenantId=1'

Inspect application logs for suspicious queries targeting tenant records. Enable debug logging in JeecgBoot to capture detailed request information.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged attackers could exploit this to access sensitive tenant data, including join codes and company details. This could lead to unauthorized access to tenant-specific information, potential data breaches, and misuse of confidential business or personal data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive tenant data to unauthorized users. Non-compliance may result in legal penalties, fines, or reputational damage due to unauthorized data access or disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade JeecgBoot to version 3.9.5 or later to patch the missing authorization flaw. If immediate upgrade is not possible, restrict access to the /sys/tenant/queryTenantAuthInfo endpoint using web application firewalls or network-level controls.

Implement strict input validation to prevent integer-based tenant ID enumeration. Review and audit all user roles to ensure least privilege access to tenant data.

Useful 0 Not Useful 0