Insecure Direct Object Reference in JeecgBoot Allows Unauthorized Access to AI Chat Variables

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in JeecgBoot through version 3.9.5. It allows authenticated users to read other users' AI chat variables by manipulating the username parameter in a POST request to /airag/api/getChatVariable. Attackers can retrieve stored chat memory values from Redis without proper authorization checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor POST requests to /airag/api/getChatVariable endpoint. Check for requests with username parameters attempting to access other users' data. Use tools like curl to test the endpoint: curl -X POST -d '{"appId":"test","username":"target_user","variableName":"test"}' http://<target>/airag/api/getChatVariable. Inspect Redis for unauthorized access patterns or unusual chat variable reads.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive chat data of other users, leading to potential data breaches, privacy violations, or exposure of confidential information stored in AI chat variables.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing personal or sensitive data without authorization. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to the latest version beyond 3.9.5. Implement strict input validation for username parameters in /airag/api/getChatVariable. Add authentication checks to verify user ownership of requested data. Restrict Redis access to authorized services only and audit logs for suspicious activity.

Useful 0 Not Useful 0