JeecgBoot Missing Authorization Exposes User Role Data

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SystemApiController's getUserRoleSetById handler. This flaw allows any authenticated user to read role assignments of other users by supplying an arbitrary userId parameter. Attackers can identify administrator accounts without needing the required system:user:queryUserRole permission.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized access to user role assignments. Monitor API logs for requests to SystemApiController with getUserRoleSetById and arbitrary userId parameters. Look for repeated queries targeting different user IDs by the same authenticated user.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged attackers could exploit this to gather sensitive information about user roles and permissions. This could help them plan further attacks, escalate privileges, or target high-value accounts like administrators. The impact includes unauthorized data access and potential system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's access control requirements. Organizations may face compliance violations, legal penalties, and reputational damage due to insufficient authorization controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later. Restrict access to the SystemApiController getUserRoleSetById endpoint by implementing proper authorization checks. Review logs for past exploitation attempts and revoke any unauthorized role queries.

Useful 0 Not Useful 0