JeecgBoot Missing Authorization in SystemApiController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SystemApiController's queryUserRoles handler. This flaw allows authenticated users to read any user's role codes by sending a GET request to /sys/api/queryUserRoles with an arbitrary username. Attackers with low privileges can exploit this to enumerate role assignments and identify administrator accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP GET requests to /sys/api/queryUserRoles with arbitrary usernames. Use network traffic analysis tools like Wireshark or tcpdump to inspect requests targeting this endpoint. Check server logs for repeated GET requests with varying username parameters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows low-privileged attackers to gather sensitive information about user roles and identify administrator accounts. This can lead to further attacks such as privilege escalation, unauthorized access to sensitive data, or targeted phishing attempts against high-privilege users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later. Implement strict access controls to restrict access to /sys/api/queryUserRoles. Use web application firewalls to block unauthorized requests to this endpoint. Review and audit user role assignments to identify potential misuse.

Useful 0 Not Useful 0