CVE-2021-37306: Insecure Permissions issue in jeecg-boot
Summary
CVE-2021-37306: Insecure Permissions issue in jeecg-boot. Affects org.jeecgframework.boot:jeecg-boot-base versions < 2.4.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jeecg-boot is a Maven package that provides a framework for developing enterprise-level Java applications. It offers various features and functionalities to simplify the development process. However, versions 2.4.5 and earlier of jeecg-boot are vulnerable to an Insecure Permissions issue. This vulnerability allows remote attackers to gain escalated privileges and access sensitive information by exploiting the 'api uri:/sys/user/checkOnlyUser?username=admin' endpoint.
Vulnerability Detail
The Insecure Permissions issue in jeecg-boot arises from improper access control mechanisms. By sending a specially crafted request to the 'api uri:/sys/user/checkOnlyUser?username=admin' endpoint, an attacker can bypass authentication and gain unauthorized access to sensitive information. This can lead to various security risks, including the exposure of confidential data, unauthorized modifications, and potential privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the vulnerable endpoint by implementing additional access controls or by disabling the endpoint altogether. This can be achieved by modifying the application's configuration or by using a web application firewall (WAF) to filter and block requests to the vulnerable URI.
Conclusion
In summary, the Insecure Permissions issue in jeecg-boot 2.4.5 and earlier versions allows remote attackers to gain escalated privileges and access sensitive information. It is crucial to upgrade to a patched version, implement proper access controls, and protect sensitive data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jeecgframework.boot:jeecg-boot-base →
FAQ
jeecg-boot is a Maven package that provides a framework for developing enterprise-level Java applications. It offers various features and functionalities to simplify the development process.
This vulnerability allows remote attackers to gain escalated privileges and access sensitive information. It can lead to the exposure of confidential data, unauthorized modifications, and potential privilege escalation.
To fix this vulnerability, it is recommended to upgrade to a patched version of jeecg-boot. Ensure proper access controls are in place and sensitive information is adequately protected.
As a temporary workaround, restrict access to the vulnerable endpoint by implementing additional access controls or by disabling the endpoint altogether.
More information about jeecg-boot can be found on the official project website or the project's repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jeecgframework.boot:jeecg-boot-base.
