JeecgBoot Missing Authorization in SysTenantController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysTenantController deleteApply handler. This flaw allows any authenticated user, even with low privileges, to reject tenant administrator applications by sending PUT requests with arbitrary tenantId, packId, and userId values. This lets attackers delete pending applications in any tenant and notify applicants of rejection.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for PUT requests targeting the SysTenantController deleteApply endpoint with parameters tenantId, packId, and userId. Check application logs for unauthorized rejections of tenant administrator applications.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to disrupt tenant administration by rejecting legitimate administrator applications. This could prevent new tenants from being properly set up or cause existing ones to lose administrative access, leading to operational disruptions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows low-privileged attackers to reject tenant administrator applications by sending crafted PUT requests, potentially disrupting legitimate access controls. This could undermine compliance with standards requiring strict access management and audit trails, such as GDPR's data protection principles or HIPAA's access control requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later. Implement strict access controls to restrict PUT requests to authorized users only. Review application logs for signs of exploitation and revoke unauthorized rejections.

Useful 0 Not Useful 0