Missing Authorization in JeecgBoot Lets Users Modify Role Data Rules

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController. This flaw allows low-privileged authenticated users to modify department role data rules by sending crafted permissionId, roleId, and dataRuleIds values. The vulnerability enables attackers to overwrite data_rule_ids, which can expand row-level data access or alter filtering for other department roles.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for POST requests targeting /sys/role/saveDatarule with parameters permissionId, roleId, and dataRuleIds. Check application logs for unauthorized modifications to department role data rules by low-privileged users.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data by modifying data rules for department roles. This could lead to data leaks, unauthorized modifications, or bypassing access controls, potentially affecting data integrity and confidentiality for users with low privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, violating principles of data protection and access control required by GDPR and HIPAA. Non-compliance may result in legal penalties, reputational damage, and loss of trust due to potential data breaches or unauthorized data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest JeecgBoot patch to version 3.9.5 or higher. Restrict write permissions for SysDepartRoleController to admin-only. Monitor and audit role data rule changes for suspicious activity.

Useful 0 Not Useful 0