JeecgBoot Missing Authorization Exposes User Data

Executive Summary

JeecgBoot through version 3.9.5 has a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler. This flaw allows any authenticated user to retrieve other users' account records by supplying arbitrary userId values. Attackers can obtain sensitive information such as names, emails, phone numbers, employee numbers, department assignments, and staff lists of departments those users head.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized access to user account records via the SysUserController queryChildrenByUsername endpoint. Monitor logs for requests with arbitrary userId parameters. Test by sending authenticated requests with varying userId values to see if sensitive data is returned.

Useful 0 Not Useful 0

Impact Analysis

Low-privileged attackers can exploit this vulnerability to access sensitive user data, including personal information like emails and phone numbers. This could lead to privacy breaches, identity theft, or unauthorized access to internal organizational data. Organizations using JeecgBoot versions up to 3.9.5 are at risk of data exposure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Exploitation of this flaw may result in legal penalties, fines, and reputational damage for organizations failing to secure user data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update JeecgBoot to version 3.9.5 or later. If an update is not possible, restrict access to the SysUserController endpoint via network policies or application-level controls. Review and audit all user data access logs for suspicious activity.

Useful 0 Not Useful 0