CVE-2025-10978

Executive Summary

CVE-2025-10978 is a publicly disclosed improper authorization vulnerability in JeecgBoot, a popular open-source Java low-code development platform. The flaw resides in the /sys/user/exportXls endpoint, specifically within the Filter Handler component. An unauthenticated remote attacker can exploit this vulnerability to export user data (including potentially sensitive information) without proper authorization. The CVSS score is 4.3 (Medium), but the public availability of exploit code and the lack of vendor response elevate the risk. The vulnerability affects all versions up to and including 3.8.2. No patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the JeecgBoot framework itself, which is typically deployed as a Java WAR or JAR file. Organizations using JeecgBoot should treat this as a critical supply chain risk due to the lack of vendor response and the potential for data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the only one affected.
• Confidentiality (C): Low (L) - Limited data exposure (user export data).
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No denial of service.

Threat Level: Medium. The low complexity and public exploit make it a high-priority target for automated scanning and opportunistic attacks.

Deep Dive & Mechanics

The vulnerability is an improper authorization (CWE-285) in the Filter Handler of JeecgBoot. The /sys/user/exportXls endpoint is designed to export user data to an Excel file. The flaw allows an unauthenticated attacker to directly access this endpoint without proper session validation or permission checks.

Root Cause: The Filter Handler, which is supposed to enforce authentication and authorization for all /sys/user/* endpoints, fails to properly validate the request for the exportXls function. This allows the request to bypass the security filter and reach the controller method, which then executes the export logic.

Attack Flow:

1. Attacker identifies a target running JeecgBoot (e.g., via Shodan or Google dorking).
2. Attacker sends a crafted HTTP GET request to /sys/user/exportXls with optional parameters (e.g., ?selections=id,username,email).
3. The server, lacking proper authorization checks, processes the request and returns an Excel file containing user data.
4. Attacker downloads the file and extracts sensitive information.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. The fix would require adding authorization checks to the exportXls method.

Vulnerable Code (JeecgBoot <= 3.8.2):

// In SysUserController.java
@RequestMapping(value = "/exportXls")
public void exportXls(HttpServletRequest request, HttpServletResponse response, SysUser sysUser) {
    // No authorization check - directly processes the request
    List<SysUser> pageList = sysUserService.selectList(sysUser);
    // ... export logic
}

Patched Code (Hypothetical Fix):

// In SysUserController.java
@RequestMapping(value = "/exportXls")
public void exportXls(HttpServletRequest request, HttpServletResponse response, SysUser sysUser) {
    // Add authorization check
    if (!hasPermission("user:export")) {
        throw new UnauthorizedException("No permission to export users");
    }
    List<SysUser> pageList = sysUserService.selectList(sysUser);
    // ... export logic
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running JeecgBoot <= 3.8.2
• Network access to the target

Exploit Steps:

1. Reconnaissance: Use Shodan or Google dorking to find targets.
2. Direct Exploitation: Send a GET request to the vulnerable endpoint.

# Simple curl command to exploit
curl -X GET "http://target.com/sys/user/exportXls" -o users.xls

# With specific fields
curl -X GET "http://target.com/sys/user/exportXls?selections=id,username,email,phone" -o users.xls

Expected Output: An Excel file (users.xls) containing user data from the database.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual GET requests to /sys/user/exportXls from unauthenticated sources.
• Look for spikes in outbound data transfer from the application server.
• Check logs for 200 responses to /sys/user/exportXls without prior authentication.

Defense:

• Immediate: Block access to /sys/user/exportXls at the web application firewall (WAF) or reverse proxy level.
• Configuration: Disable the export feature if not needed.
• Code Fix: Implement proper authorization checks (see patched code above).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /sys/user/exportXls
  • User-Agent strings from common scanning tools (e.g., curl, python-requests)
  • Outbound HTTP responses containing Excel file headers (Content-Type: application/vnd.ms-excel)
• File IOCs:
  • Excel files named users.xls or similar in temporary directories
  • Log entries showing successful export without prior login
• System IOCs:
  • Unusual access to the /sys/user/exportXls endpoint in access logs
  • High CPU/memory usage during export operations

Detection Engineering

YARA Rule

rule CVE_2025_10978_JeecgBoot_ExportXls {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10978 in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10978"
    strings:
        $s1 = "/sys/user/exportXls" ascii wide nocase
        $s2 = "selections=" ascii wide nocase
        $s3 = "Content-Type: application/vnd.ms-excel" ascii wide nocase
    condition:
        any of ($s1, $s2) or $s3
}

Sigma Rule

title: CVE-2025-10978 - JeecgBoot Unauthorized User Export
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the vulnerable /sys/user/exportXls endpoint in JeecgBoot
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/sys/user/exportXls'
    condition: selection
falsepositives:
    - Legitimate admin exports (should be rare)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10978 - JeecgBoot Unauthorized User Export Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/sys/user/exportXls"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-10978;
)

Remediation & Mitigation

Immediate Actions:

1. Block the endpoint: Add a rule to your WAF or reverse proxy to block all requests to /sys/user/exportXls from untrusted networks.
2. Disable the feature: If possible, remove or disable the user export functionality in your JeecgBoot configuration.
3. Monitor logs: Actively monitor access logs for exploitation attempts.

Long-term Fix:

• Patch: Since the vendor has not responded, you must manually patch the code. Add authorization checks to the exportXls method in SysUserController.java as shown in the patched code section.
• Upgrade: Watch for an official patch from JeecgBoot and upgrade immediately when available.
• Network Segmentation: Ensure the application is not directly exposed to the internet. Use a VPN or internal network access.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.