JeecgBoot Missing Authorization in SysUserController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysUserController addSysUserGroup handler. This allows any authenticated user to modify user group membership without proper permission checks. Low-privileged attackers can send POST requests with arbitrary user IDs and a group ID to add users to administrator-maintained groups.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the endpoint /sys/user/addSysUserGroup is accessible without proper authorization. Use tools like curl to send a POST request with arbitrary user IDs and group IDs to see if the system allows unauthorized group membership modifications. Example: curl -X POST -d 'userIds=1&groupId=1' http://target.com/sys/user/addSysUserGroup

Verify if the endpoint lacks @RequiresPermissions or @RequiresRoles annotations. Check server logs for unauthorized POST requests to this endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to add themselves or others to privileged groups, potentially gaining elevated access. Attackers could escalate privileges, access sensitive data, or perform administrative actions without proper authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data by allowing low-privileged users to modify group memberships, potentially granting excessive permissions. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized access to personal or protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to a version beyond 3.9.5 if available. If not, restrict access to the /sys/user/addSysUserGroup endpoint via firewall rules or web application firewall (WAF).

Implement proper authorization checks in the endpoint handler, such as adding @RequiresPermissions or @RequiresRoles annotations. Monitor logs for suspicious POST requests to this endpoint.

Useful 0 Not Useful 0