CVE-2021-44585: Cross-site Scripting in jeecg-boot
Summary
CVE-2021-44585: Cross-site Scripting in jeecg-boot. Affects org.jeecgframework.boot:jeecg-boot-base versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jeecg-boot is a code generator that is used for generating code in Java. It is built on top of the Spring Boot framework and provides various features for rapid application development. The package affected by this vulnerability is org.jeecgframework.boot:jeecg-boot-base. This vulnerability allows for Cross-Site Scripting (XSS) attacks to occur in the jeecg-boot application. The specific vulnerability exists in the /jeecg-boot/jmreport/view endpoint, where a mouseover event can trigger the XSS attack.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in jeecg-boot 3.0 allows an attacker to inject malicious scripts into web pages viewed by other users. This can lead to various security issues, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. The vulnerability is due to insufficient input validation and sanitization of user-supplied data. By exploiting this vulnerability, an attacker can execute arbitrary JavaScript code in the context of the affected user's browser.
How To Fix
Minimum fixed version
3.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable the affected endpoint or implement input validation and sanitization measures to prevent the execution of malicious scripts. Here is an example of how to disable the endpoint in a Spring Boot application:
@Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/jeecg-boot/jmreport/view").denyAll()
.
anyRequest().permitAll();
}
}
Conclusion
The Cross-Site Scripting (XSS) vulnerability in jeecg-boot 3.0 can lead to serious security issues, including the theft of sensitive information and unauthorized actions on behalf of users. It is crucial to upgrade to version 3.1.0 or later to patch the vulnerability. If immediate upgrading is not possible, implementing a temporary workaround, such as disabling the affected endpoint or implementing input validation and sanitization measures, can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jeecgframework.boot:jeecg-boot-base →
FAQ
jeecg-boot is a code generator used for rapid application development in Java. It is built on top of the Spring Boot framework and provides various features for generating code and scaffolding applications.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various security issues, such as stealing sensitive information or performing actions on behalf of the user.
The XSS vulnerability in jeecg-boot occurs in the /jeecg-boot/jmreport/view endpoint. This endpoint does not properly validate and sanitize user-supplied data, allowing an attacker to inject malicious scripts that will be executed in the context of the affected user's browser.
The XSS vulnerability in jeecg-boot can lead to various security issues, such as stealing sensitive information, session hijacking, or performing actions on behalf of the user. An attacker can execute arbitrary JavaScript code in the context of the affected user's browser, potentially compromising their account and the security of the application.
To protect your jeecg-boot application from this vulnerability, it is recommended to upgrade to version 3.1.0 or later, which includes a fix for the XSS vulnerability. Additionally, you should always validate and sanitize user-supplied data to prevent the execution of malicious scripts.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jeecgframework.boot:jeecg-boot-base.
