JeecgBoot vulnerabilities

An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module.

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload.

A vulnerability was identified in JeecgBoot up to 3.9.2 in an unknown function of the file /airag/chat/send of the Anonymous Chat Attachment Parser component, allowing server-side request forgery. The attack can be initiated remotely and the exploit is publicly available.

A broken access control vulnerability in JeecgBoot through version 3.9.2 allows authenticated low-privilege users full CRUD operations on OpenAPI credentials. The lack of Shiro authorization annotations in OpenApiAuthController and OpenApiPermissionController enables listing, adding, editing, and deleting all AK/SK pairs, with the list endpoint exposing secret keys in plaintext.

An open redirect vulnerability was found in JeecgBoot up to version 3.9.2 in the Third-Party Login component. The attack requires social engineering and is difficult to exploit.

An information disclosure vulnerability was found in JeecgBoot up to version 3.9.2 in the queryPageList function of SysUserController.java. Manipulating the 'salt' argument allows remote unauthorized data access.

In jeecgboot up to version 3.9.1, a server-side request forgery vulnerability exists in the FileDownloadUtils.download2DiskFromNet function of /airag/app/debug. The attack can be performed remotely and the exploit has been released. Version 3.9.2 fixes the issue.

In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in an unknown function of /airag/airagModel/test. Manipulation of the baseUrl argument allows remote attack. The exploit is publicly available.

In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in the WordUtil.addImage function of /airag/word/edit. The attack can be performed remotely and the exploit has been publicly disclosed.

In JeecgBoot up to version 3.9.1, a vulnerability in the AiragModelController component allows improper access controls via manipulation of list/queryById arguments. The attack can be executed remotely, and the exploit is public. Fixed in version 3.9.2.

In JeecgBoot up to version 3.9.1, a vulnerability was identified in an unknown function of the file /sys/comment/add, leading to improper access controls. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.9.2 resolves the issue.

Vulnerability in JeecgBoot up to version 3.9.1 in the LoginController.selectDepart function in /sys/selectDepart, due to improper access controls. The attack can be performed remotely.

In JeecgBoot up to version 3.9.1, a vulnerability was found in the function user.getUsername of the file /sys/user/login/setting/userEdit of the SysUser component. Manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public. Upgrading to version 3.9.2 is recommended.

In JeecgBoot 3.9.1, the OpenAPI Endpoint component in the file /openapi/call/ has an improper authentication vulnerability. The attack is remote with high complexity, and the vendor did not respond.

JeecgBoot 3.9.1 has an authorization bypass vulnerability in the mLogin endpoint. The attack can be carried out remotely but is considered difficult to exploit.

JeecgBoot up to version 3.9.1 contains a Cross-Site Scripting vulnerability in the SVG file handler component. An unknown function in CommonController.java allows remote script injection. The exploit is publicly available.

In JeecgBoot 3.9.0/3.9.1, a missing authentication vulnerability was found in the AI Chat module in file JeecgBizToolsProvider.java. The attack can be performed remotely. A patch is available in the repository but not yet included in an official release.