Missing Authorization in JeecgBoot Allows Message Deletion

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysMessageController delete handler. Low-privileged authenticated users can delete message records by sending DELETE requests with arbitrary ID values, removing any sys_sms row without ownership checks. The vulnerability exists because the controller lacks proper authorization annotations like @RequiresPermissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unauthenticated or low-privileged users can delete messages via the DELETE /sys/message/sysMessage/delete endpoint. Use tools like curl to send test DELETE requests with arbitrary IDs. Example: curl -X DELETE http://target.com/sys/message/sysMessage/delete?id=1. If the request succeeds without proper authorization, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Attackers with low privileges can delete message records, including sent notifications, without detection. This could erase audit trails, disrupt communication logs, or hide evidence of malicious activity. The impact includes data loss and potential system misuse.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate data integrity and retention. GDPR requires data accuracy and accountability, while HIPAA mandates secure and auditable records. Unauthorized deletions may lead to non-compliance penalties or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to a version beyond 3.9.5. If an update is not possible, restrict access to the DELETE /sys/message/sysMessage/delete endpoint by implementing proper authorization checks, such as adding @RequiresPermissions annotations. Temporarily disable the endpoint if necessary.

Useful 0 Not Useful 0