JeecgBoot Missing Authorization in SysUserController

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the putCancelQuit handler of SysUserController. This flaw allows any authenticated user to cancel user resignations by providing user IDs and a tenantId parameter or X-Tenant-Id header. Low-privileged attackers can exploit this to restore ended, pending, or refused tenant memberships to normal status.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized PUT requests to the /sys/user/putCancelQuit endpoint. Monitor logs for requests with user IDs and tenantId or X-Tenant-Id headers that modify user status without proper authorization. Use network traffic analysis tools to inspect HTTP PUT requests targeting this path.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could reactivate terminated or suspended user accounts, potentially regaining access to systems or data they were previously removed from. This could lead to unauthorized access, data breaches, or privilege escalation within the affected application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate proper user deactivation and access control, such as GDPR's data protection principles or HIPAA's access management rules. Unauthorized reactivation of accounts may lead to unauthorized data access, resulting in potential legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to a version beyond 3.9.5. If an update is not possible, restrict access to the /sys/user/putCancelQuit endpoint via firewall rules or network segmentation. Implement strict permission checks and validate tenant IDs against the authenticated user's JWT token.

Useful 0 Not Useful 0