CVE-2025-10980

Executive Summary

CVE-2025-10980 is a publicly disclosed improper authorization vulnerability in JeecgBoot, a popular open-source low-code development platform. The flaw resides in the /sys/position/exportXls endpoint, allowing an unauthenticated remote attacker to export sensitive position data without proper authorization checks. The vendor (Jeecgboot) was contacted but has not responded, and no official patch is available as of this report. The CVSS score is 4.3 (Medium), but the public availability of exploit details elevates the risk for unpatched instances.

Supply Chain & Package Security

JeecgBoot is a Java-based framework distributed via Maven Central and GitHub. Organizations using JeecgBoot as a dependency in their own applications should treat this as a supply chain risk. The vulnerable component is the jeecg-boot-module-system module. Until a patch is released, teams must implement compensating controls at the network or application layer.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of position data)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability is trivial to exploit remotely without authentication, but the impact is limited to data exposure (position/role information). However, this data can be used for reconnaissance in targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862) . The endpoint /sys/position/exportXls is designed to export position data (e.g., job titles, department roles) to an Excel file. In vulnerable versions, the controller method handling this request does not verify whether the requesting user has the required permissions (e.g., hasPermission('system:position:export')).

The request is a simple GET or POST to the endpoint. The server processes the export without checking the user's session or role. This allows any unauthenticated attacker to download the full list of positions, which may include sensitive organizational structure information.

Root Cause: The @RequiresPermissions annotation (from Apache Shiro) or similar authorization check is missing from the controller method for the export functionality.

Vulnerable vs. Patched Code

Vulnerable Code (JeecgBoot <= 3.8.2):

// In PositionController.java
@RequestMapping(value = "/exportXls")
public void exportXls(HttpServletRequest request, HttpServletResponse response, PositionEntity position) {
    // No authorization check
    List<PositionEntity> list = positionService.list();
    // ... export logic
}

Patched Code (Hypothetical fix):

// In PositionController.java
@RequestMapping(value = "/exportXls")
@RequiresPermissions("system:position:export")  // Missing in vulnerable version
public void exportXls(HttpServletRequest request, HttpServletResponse response, PositionEntity position) {
    List<PositionEntity> list = positionService.list();
    // ... export logic
}

The fix adds the @RequiresPermissions annotation to enforce authorization. Without this, any user (including unauthenticated) can trigger the export.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running JeecgBoot <= 3.8.2
• Network access to the /sys/position/exportXls endpoint

Exploit Steps:

1. Send a simple GET request to the vulnerable endpoint:

   curl -v "http://target.com/jeecg-boot/sys/position/exportXls"
   

2. The server will respond with an Excel file (.xls) containing all position records.
3. Save the output:

   curl -o positions.xls "http://target.com/jeecg-boot/sys/position/exportXls"
   

Expected Output: An Excel file with columns like id, name, code, sortOrder, etc., revealing the organizational structure.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for requests to /sys/position/exportXls from unauthenticated sources.
2. Check web server logs for unusual patterns (e.g., repeated requests to this endpoint from a single IP).
3. Verify if the endpoint is accessible without a valid session token.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/jeecg-boot/sys/position/exportXls"
| stats count by src_ip, user_agent, status
| where status=200

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /jeecg-boot/sys/position/exportXls (GET or POST)
  • Response Content-Type: application/vnd.ms-excel
  • Response body containing Excel binary data (starts with D0 CF 11 E0 A1 B1 1A E1)

• File IOCs:

  • Downloaded files named positions.xls or similar
  • Excel files containing columns: id, name, code, parentId, sortOrder

• Log IOCs:

  • Web server logs showing 200 responses to /sys/position/exportXls without prior authentication

Detection Engineering

YARA Rule

rule CVE_2025_10980_JeecgBoot_ExportXls {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10980 via HTTP request patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10980"
    strings:
        $uri = "/sys/position/exportXls"
        $method_get = "GET"
        $method_post = "POST"
        $content_type = "application/vnd.ms-excel"
    condition:
        any of ($uri) and any of ($method_get, $method_post)
}

Sigma Rule

title: CVE-2025-10980 JeecgBoot Unauthorized Position Export
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized access to the /sys/position/exportXls endpoint in JeecgBoot
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem: "/jeecg-boot/sys/position/exportXls"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin exports (should be rare and authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10980 JeecgBoot Unauthorized Position Export"; flow:to_server; http.uri; content:"/sys/position/exportXls"; http.method; content:"GET"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Block /sys/position/exportXls at the web server or reverse proxy level.
2. Implement authentication check via a WAF rule to require a valid session token for this endpoint.
3. Upgrade to a patched version when available (monitor JeecgBoot GitHub releases).

Long-term Fix:

• Add @RequiresPermissions("system:position:export") to the controller method.
• Conduct a full authorization audit of all export endpoints in the application.

Workaround (Nginx):

location /jeecg-boot/sys/position/exportXls {
    deny all;
    return 403;
}

Workaround (Apache .htaccess):

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^jeecg-boot/sys/position/exportXls - [F,L]
</IfModule>

Valters IT
DevSecOps & Cyber Threat Intelligence