CVE-2025-10979

Executive Summary

CVE-2025-10979 identifies a critical authorization bypass vulnerability in JeecgBoot, an open-source low-code development platform. The flaw resides in the /sys/role/exportXls endpoint, which fails to enforce proper authorization checks. This allows an authenticated attacker to export role data (including potentially sensitive role names, permissions, and user mappings) without the required administrative privileges. The vulnerability is remotely exploitable and has a public proof-of-concept (PoC), increasing the risk of targeted attacks. As of this report, the vendor has not responded to disclosure attempts, and no official patch is available.

Supply Chain & Package Security

JeecgBoot is a Java-based framework distributed via Maven Central and GitHub. Organizations using JeecgBoot as a dependency in their own applications should treat this as a supply chain risk. The vulnerable component is the jeecg-boot-module-system module. Until a patch is released, teams must implement compensating controls.

CVSS Breakdown & Threat Level

CVSS Score: 4.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid low-privileged account.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): Low – Limited sensitive data (role definitions) is exposed.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial-of-service impact.

Threat Level: Medium. The low complexity and public exploit availability make this a realistic threat for organizations using JeecgBoot.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Function Level Access Control (CWE-862). The endpoint /sys/role/exportXls is designed to export role data to an Excel file. In a properly secured application, this endpoint should be restricted to users with administrative roles (e.g., ROLE_ADMIN). However, the code does not perform any authorization check before executing the export logic.

Root Cause Analysis:

1. The controller method handling /sys/role/exportXls is annotated with @RequestMapping but lacks a @PreAuthorize or similar security annotation.
2. The method directly calls the service layer to fetch all roles and write them to an XLS file.
3. No validation of the current user's permissions is performed within the method body.

Attack Flow:

1. Attacker authenticates as a low-privileged user (e.g., a regular employee).
2. Attacker sends a GET request to /sys/role/exportXls.
3. The server returns an XLS file containing all role definitions, including role names, permission codes, and user-role mappings.
4. Attacker can use this information to map out the application's permission structure and identify high-value targets.

Vulnerable vs. Patched Code

Vulnerable Code (JeecgBoot <= 3.8.2):

@GetMapping("/exportXls")
public void exportXls(HttpServletRequest request, HttpServletResponse response) {
    // No authorization check
    List<SysRole> pageList = sysRoleService.list();
    // ... export logic
}

Patched Code (Hypothetical Fix):

@GetMapping("/exportXls")
@PreAuthorize("hasRole('ROLE_ADMIN')")
public void exportXls(HttpServletRequest request, HttpServletResponse response) {
    List<SysRole> pageList = sysRoleService.list();
    // ... export logic
}

The fix requires adding a Spring Security @PreAuthorize annotation or an equivalent manual check to ensure only administrators can access the endpoint.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid low-privileged user account on a JeecgBoot instance (version <= 3.8.2).
• Network access to the target application.

Exploitation Steps:

1. Obtain a session cookie or JWT token for the low-privileged user.
2. Send a GET request to the vulnerable endpoint:

   curl -X GET "http://target.com/sys/role/exportXls" \
        -H "Cookie: JSESSIONID=your_session_id" \
        -o roles.xls
   

3. Open the downloaded roles.xls file to view all role definitions.

Expected Output: An Excel file containing columns such as id, role_name, role_code, description, and potentially user_ids.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor access logs for requests to /sys/role/exportXls from non-admin users.
2. Alert on any successful download of the XLS file by a user without the ROLE_ADMIN role.
3. Correlate with authentication logs to identify the user performing the export.

Response Actions:

1. Immediately revoke the session of the suspicious user.
2. Review the exported data to assess the scope of the breach.
3. If sensitive data was exposed, initiate incident response procedures.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /sys/role/exportXls with a 200 OK response and Content-Type: application/vnd.ms-excel.
• User-Agent strings that do not match typical browser patterns (e.g., curl/7.x, python-requests/2.x).

File IOCs:

• Excel files (.xls) containing role definitions exported from the application.
• File names such as roles.xls, export.xls, or role_export.xls.

Log IOCs:

• Access log entries showing GET /sys/role/exportXls from IP addresses not associated with administrators.
• Authentication logs showing a low-privileged user accessing the endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_10979_JeecgBoot_Role_Export {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10979 via HTTP request patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10979"
    strings:
        $http_method = "GET"
        $uri = "/sys/role/exportXls"
        $user_agent_curl = "curl" nocase
        $user_agent_python = "python-requests" nocase
    condition:
        $http_method at 0 and $uri and (#user_agent_curl > 0 or #user_agent_python > 0)
}

Sigma Rule

title: CVE-2025-10979 JeecgBoot Role Export Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized access to the /sys/role/exportXls endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/sys/role/exportXls'
    condition: selection
falsepositives:
    - Legitimate admin activity
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10979 JeecgBoot Role Export Exploitation";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/sys/role/exportXls";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If possible, block access to /sys/role/exportXls at the web server or API gateway level.
2. Implement a WAF rule: Create a custom rule to block requests to this endpoint from non-admin IP ranges.
3. Review user permissions: Audit all user accounts and ensure only administrators have access to export functionality.

Long-Term Fix:

1. Apply the patch: Once the vendor releases a fix, upgrade to the patched version immediately.
2. Code review: Conduct a thorough review of all controller methods to ensure proper authorization checks are in place.
3. Implement RBAC: Use Spring Security's method-level security annotations (@PreAuthorize, @Secured) consistently.

Compensating Controls:

• Enable detailed audit logging for all export operations.
• Implement rate limiting on the /sys/role/exportXls endpoint.
• Use a Web Application Firewall (WAF) to inspect and block suspicious requests.

Valters IT
Securing Your Digital Future