Missing Authorization in JeecgBoot Allows Role Data Rule Modification

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysRoleController saveDatarule handler. Low-privileged authenticated users can modify role data rules by sending parameters like permissionId, roleId, and dataRuleIds. This allows overwriting data_rule_ids, clearing row-level filters to widen access to readable records or altering filtering for other roles.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your JeecgBoot instance allows unauthorized POST requests to the /sys/role/datarule endpoint. Use tools like curl to send a test request with parameters permissionId, roleId, and dataRuleIds. If the server responds with HTTP 200 and processes the request without permission checks, the system is likely vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could escalate their access by removing row-level filters, allowing them to view or modify data they shouldn't have permission to access. This could lead to unauthorized data exposure, data manipulation, or privilege escalation within the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and privacy such as GDPR and HIPAA. It may result in data breaches, unauthorized data exposure, or improper data handling, all of which are critical compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to a version beyond 3.9.5. If an update is not possible, restrict access to the /sys/role/datarule endpoint by implementing proper authorization checks such as @RequiresPermissions or @RequiresRoles annotations. Review and remove any unnecessary permissions for low-privileged users.

Useful 0 Not Useful 0