CVE-2025-10981

Executive Summary

CVE-2025-10981 is an improper authorization vulnerability in JeecgBoot, an open-source Java rapid development platform. The flaw exists in the /sys/tenant/exportXls endpoint, allowing an unauthenticated remote attacker to export tenant data without proper authorization checks. The vulnerability affects all versions up to and including 3.8.2. The exploit has been publicly disclosed, and the vendor has not responded to disclosure attempts. The CVSS score is 4.3 (Medium), with a low confidentiality impact. No EPSS score is available, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the JeecgBoot framework. Organizations using JeecgBoot as a dependency in their Java projects should assess their exposure.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is Medium due to the low confidentiality impact and lack of integrity or availability impact. However, the public availability of the exploit increases the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability resides in the /sys/tenant/exportXls endpoint of JeecgBoot. This endpoint is intended to export tenant data in Excel format. The flaw is due to missing or improper authorization checks, allowing any unauthenticated user to trigger the export functionality. The endpoint likely lacks a check for a valid session token or role-based access control (RBAC) permissions.

The attack is straightforward: an attacker sends a crafted HTTP request to the vulnerable endpoint, and the server responds with an Excel file containing tenant data. The data exposed could include tenant names, IDs, configurations, or other sensitive information depending on the implementation.

The root cause is a missing @PreAuthorize annotation or similar authorization guard on the controller method handling the export. In Spring-based applications like JeecgBoot, this is a common oversight.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be the current implementation. A patched version would include proper authorization checks.

Vulnerable Code (Conceptual):

@GetMapping("/sys/tenant/exportXls")
public void exportXls(HttpServletRequest request, HttpServletResponse response) {
    // No authorization check
    List<Tenant> tenants = tenantService.list();
    // Export logic
}

Patched Code (Conceptual):

@GetMapping("/sys/tenant/exportXls")
@PreAuthorize("hasAuthority('tenant:export')")
public void exportXls(HttpServletRequest request, HttpServletResponse response) {
    List<Tenant> tenants = tenantService.list();
    // Export logic
}

The patch adds a @PreAuthorize annotation to ensure only users with the tenant:export permission can access the endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running JeecgBoot <= 3.8.2
• Network access to the /sys/tenant/exportXls endpoint

Exploit Steps:

1. Identify the target URL (e.g., http://target.com/jeecg-boot/sys/tenant/exportXls).
2. Send a GET request to the endpoint without any authentication headers.
3. The server will respond with an Excel file containing tenant data.

Example cURL Command:

curl -X GET "http://target.com/jeecg-boot/sys/tenant/exportXls" -o tenant_data.xls

Expected Output: The file tenant_data.xls will contain tenant information.

Blue Team

Detection:

• Monitor for requests to /sys/tenant/exportXls from unauthenticated sources.
• Look for unusual patterns in web server logs, such as repeated requests to this endpoint from the same IP.

Hunting:

• Search for HTTP 200 responses to /sys/tenant/exportXls without prior authentication events.
• Check for Excel file downloads (.xls or .xlsx) triggered by this endpoint.

Lab Setup:

• Deploy a vulnerable JeecgBoot instance (version 3.8.2) in an isolated environment.
• Use a web application firewall (WAF) to test detection rules.
• Simulate the exploit using the cURL command above.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /sys/tenant/exportXls
  • Responses with Content-Type: application/vnd.ms-excel or application/octet-stream
  • User-Agent strings from common tools (e.g., curl, python-requests)
• File:
  • Unexpected .xls or .xlsx files on the server or in network traffic
• Logs:
  • Web server logs showing access to /sys/tenant/exportXls without prior authentication

Detection Engineering

YARA Rule

rule CVE_2025_10981_JeecgBoot_ExportXls {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10981 in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10981"
    strings:
        $s1 = "/sys/tenant/exportXls" ascii wide nocase
        $s2 = "JeecgBoot" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-10981 JeecgBoot Unauthorized Tenant Export
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized access to the /sys/tenant/exportXls endpoint in JeecgBoot
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/sys/tenant/exportXls'
    condition: selection
falsepositives:
    - Legitimate authenticated users (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10981 JeecgBoot Unauthorized Tenant Export"; flow:to_server; content:"GET"; http_method; content:"/sys/tenant/exportXls"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If possible, block access to /sys/tenant/exportXls at the web server or WAF level.
2. Apply access controls: Implement authentication and authorization checks on the endpoint.
3. Monitor logs: Review web server logs for any suspicious access to this endpoint.

Long-term Fix:

• Apply a patch from the vendor once available. Since the vendor has not responded, consider forking the repository and implementing the fix manually.
• Upgrade to a patched version when released.

Workarounds:

• Use a reverse proxy to require authentication for the /sys/tenant/exportXls path.
• Implement network segmentation to limit access to the application.

Valters IT