JeecgBoot vulnerabilities

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every shared OCR prompt record stored in Redis.

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users.

Vulnerability in JeecgBoot up to version 3.9.3. The exportXls function in AiragModelController.java is vulnerable to improper access controls via the credential argument. The attack can be performed remotely, and the exploit is publicly disclosed. Upgrading to version 3.9.5 is recommended.

JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints (including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds) to retrieve sensitive information of all users, including real names, phone numbers, email addresses, employee numbers, and role definitions, due to missing fine-grained permission checks and incomplete data desensitization.

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload.

A vulnerability was identified in JeecgBoot up to 3.9.2 in an unknown function of the file /airag/chat/send of the Anonymous Chat Attachment Parser component, allowing server-side request forgery. The attack can be initiated remotely and the exploit is publicly available.

A broken access control vulnerability in JeecgBoot through version 3.9.2 allows authenticated low-privilege users full CRUD operations on OpenAPI credentials. The lack of Shiro authorization annotations in OpenApiAuthController and OpenApiPermissionController enables listing, adding, editing, and deleting all AK/SK pairs, with the list endpoint exposing secret keys in plaintext.

An open redirect vulnerability was found in JeecgBoot up to version 3.9.2 in the Third-Party Login component. The attack requires social engineering and is difficult to exploit.

An information disclosure vulnerability was found in JeecgBoot up to version 3.9.2 in the queryPageList function of SysUserController.java. Manipulating the 'salt' argument allows remote unauthorized data access.

In jeecgboot up to version 3.9.1, a server-side request forgery vulnerability exists in the FileDownloadUtils.download2DiskFromNet function of /airag/app/debug. The attack can be performed remotely and the exploit has been released. Version 3.9.2 fixes the issue.

In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in an unknown function of /airag/airagModel/test. Manipulation of the baseUrl argument allows remote attack. The exploit is publicly available.

In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in the WordUtil.addImage function of /airag/word/edit. The attack can be performed remotely and the exploit has been publicly disclosed.

In JeecgBoot up to version 3.9.1, a vulnerability in the AiragModelController component allows improper access controls via manipulation of list/queryById arguments. The attack can be executed remotely, and the exploit is public. Fixed in version 3.9.2.

In JeecgBoot up to version 3.9.1, a vulnerability was identified in an unknown function of the file /sys/comment/add, leading to improper access controls. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.9.2 resolves the issue.

Vulnerability in JeecgBoot up to version 3.9.1 in the LoginController.selectDepart function in /sys/selectDepart, due to improper access controls. The attack can be performed remotely.

In JeecgBoot up to version 3.9.1, a vulnerability was found in the function user.getUsername of the file /sys/user/login/setting/userEdit of the SysUser component. Manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public. Upgrading to version 3.9.2 is recommended.

In JeecgBoot 3.9.1, the OpenAPI Endpoint component in the file /openapi/call/ has an improper authentication vulnerability. The attack is remote with high complexity, and the vendor did not respond.

JeecgBoot 3.9.1 has an authorization bypass vulnerability in the mLogin endpoint. The attack can be carried out remotely but is considered difficult to exploit.

JeecgBoot up to version 3.9.1 contains a Cross-Site Scripting vulnerability in the SVG file handler component. An unknown function in CommonController.java allows remote script injection. The exploit is publicly available.

In JeecgBoot 3.9.0/3.9.1, a missing authentication vulnerability was found in the AI Chat module in file JeecgBizToolsProvider.java. The attack can be performed remotely. A patch is available in the repository but not yet included in an official release.

A weakness was identified in JeecgBoot up to version 3.9.0 in the function getPositionUserList of the file /sys/position/getPositionUserList. Manipulation of the positionId argument causes improper authorization. The attack may be initiated remotely but is difficult to exploit. The vendor was contacted but did not respond.

A security flaw was discovered in JeecgBoot up to version 3.9.0 in the function queryDepartPermission of the file /sys/permission/queryDepartPermission. Manipulation of the departId argument results in improper authorization. The attack can be launched remotely but is difficult to exploit. The vendor was contacted but did not respond.

A vulnerability in JeecgBoot up to version 3.9.0 affects the getParameterMap function in the file /sys/sysDepartPermission/list. Manipulation of the departId argument leads to improper authorization. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The exploit is publicly available.

A vulnerability in JeecgBoot up to version 3.9.0 affects an unknown function in the file /sys/sysDepartPermission/datarule/. Manipulation leads to improper authorization. The attack can be launched remotely but requires high complexity and is difficult to exploit. The exploit is publicly disclosed.

A vulnerability in JeecgBoot up to version 3.9.0 affects the loadDatarule function in the file /sys/sysDepartRole/datarule/. Manipulation of the departId/roleId arguments results in improper authorization. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The exploit has been made public.

A vulnerability was found in JeecgBoot up to version 3.9.0 in the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByUserId. Manipulation of the departId argument leads to information disclosure. The vendor was contacted but did not respond.

A flaw was found in JeecgBoot up to version 3.9.0 in the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. Manipulation of the departId argument causes improper authorization. The attack is possible to be carried out remotely but is difficult to exploit. The vendor was contacted but did not respond.

A vulnerability in JeecgBoot up to version 3.9.0 affects the queryPageList function in the file /sys/sysDepartRole/list. Manipulation of the deptId argument results in improper authorization. The attack can be executed remotely but requires high complexity and is difficult to exploit. The exploit is now public.

A weakness has been identified in JeecgBoot up to 3.9.0 in the SysUserOnlineController function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely and the exploit is public. Applying patch b686f9fbd1917edffe5922c6362c817a9361cfbd is advised.

A security flaw has been discovered in JeecgBoot up to 3.9.0. It affects an unknown function in the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java of the Multi-Tenant Management Module. Manipulation of the ID argument results in improper authentication. The attack can be initiated remotely, and the exploit has been publicly released. The patch is named e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2/67795493bdc579e489d3ab12e52a1793c4f8a0ee.