CVE-2025-15119

Executive Summary

CVE-2025-15119 is an improper authorization vulnerability (CWE-285) in JeecgBoot, an open-source Java rapid development platform. The flaw resides in the /sys/sysDepartRole/list endpoint, specifically within the queryPageList function. By manipulating the deptId parameter, an authenticated attacker can bypass authorization checks and list role data for departments they should not have access to. The attack is remotely exploitable but requires a high level of complexity, making it difficult to execute. The vendor was contacted but did not respond, and no patch is currently available. The exploit has been made public, increasing the risk of targeted attacks.

Supply Chain & Package Security

JeecgBoot is a Java-based framework distributed via Maven Central and GitHub. This vulnerability affects the core authorization module, which is a critical component for multi-tenant or department-based access control. Organizations using JeecgBoot in their supply chain should treat this as a high-priority risk, as it can lead to unauthorized data exposure across departments.

CVSS Breakdown & Threat Level

CVSS Score: 3.1 (Low) Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): High – Successful exploitation requires specific conditions or knowledge of the target environment.
• Privileges Required (PR): Low – An attacker needs a valid low-privileged account.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): Low – Limited information disclosure (role data).
• Integrity (I): None – No data modification possible.
• Availability (A): None – No denial of service.

Threat Level: Low (due to high complexity and low impact), but the public exploit and lack of patch elevate the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic improper authorization flaw in the queryPageList function of the SysDepartRoleController. The endpoint /sys/sysDepartRole/list is designed to list roles associated with a specific department. The deptId parameter is used to filter results, but the application fails to verify that the requesting user has the right to access that department's data.

Root Cause: The authorization check is either missing or incorrectly implemented. The code likely retrieves roles based on the deptId without validating the user's department membership or administrative scope.

Attack Flow:

1. Attacker authenticates as a low-privileged user (e.g., a user in Department A).
2. Attacker sends a GET request to /sys/sysDepartRole/list?deptId=<target_department_id>.
3. The server returns the list of roles for the target department, bypassing authorization.
4. Attacker can enumerate department IDs to gather role information across the organization.

Impact: Disclosure of role structures, which can aid in privilege escalation or social engineering attacks.

Vulnerable vs. Patched Code

Vulnerable Code (JeecgBoot <= 3.9.0):

// SysDepartRoleController.java
@GetMapping("/list")
public Result<List<SysDepartRole>> queryPageList(@RequestParam String deptId) {
    // Missing authorization check
    List<SysDepartRole> roles = sysDepartRoleService.listByDeptId(deptId);
    return Result.ok(roles);
}

Patched Code (Hypothetical):

// SysDepartRoleController.java
@GetMapping("/list")
public Result<List<SysDepartRole>> queryPageList(@RequestParam String deptId) {
    // Authorization check: verify user has access to the department
    if (!userService.hasDeptAccess(LoginUserUtil.getUserId(), deptId)) {
        return Result.error("Access denied");
    }
    List<SysDepartRole> roles = sysDepartRoleService.listByDeptId(deptId);
    return Result.ok(roles);
}

Key Difference: The patched version adds a hasDeptAccess check to ensure the authenticated user is authorized to view roles for the specified department.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid low-privileged user account on a JeecgBoot instance (version <= 3.9.0).
• Knowledge of a target department ID (can be enumerated via other endpoints or brute-forced).

Exploitation Steps:

1. Authenticate and obtain a session token (e.g., via login API).
2. Send a crafted GET request to the vulnerable endpoint:

   curl -X GET "http://target.com/sys/sysDepartRole/list?deptId=12345" \
        -H "Authorization: Bearer <token>"
   

3. If successful, the response will contain a JSON list of roles for department ID 12345.
4. Repeat with different deptId values to enumerate roles across departments.

Example Response:

{
  "success": true,
  "result": [
    {"id": "1", "roleName": "Admin", "deptId": "12345"},
    {"id": "2", "roleName": "Manager", "deptId": "12345"}
  ]
}

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual patterns in /sys/sysDepartRole/list requests, especially from users who should not have cross-department access.
• Look for rapid enumeration of deptId parameters (e.g., sequential IDs).

Defense:

• Implement proper authorization checks as shown in the patched code.
• Apply rate limiting on the endpoint to slow down enumeration.
• Use Web Application Firewall (WAF) rules to block suspicious requests.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /sys/sysDepartRole/list with varying deptId parameters from the same user.
  • Unusual patterns in deptId values (e.g., sequential or out-of-range IDs).
• Logs:
  • Application logs showing queryPageList calls with deptId values not associated with the user's department.
  • Authentication logs showing a low-privileged user accessing the endpoint repeatedly.
• System:
  • No file-based IOCs; this is a logic flaw in the application.

Detection Engineering

YARA Rule

rule CVE_2025_15119_JeecgBoot_Unauthorized_Access {
    meta:
        description = "Detects exploitation attempts of CVE-2025-15119 in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15119"
    strings:
        $endpoint = "/sys/sysDepartRole/list"
        $param = "deptId="
    condition:
        $endpoint and $param
}

Sigma Rule

title: CVE-2025-15119 - JeecgBoot Unauthorized Role Listing
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit improper authorization in JeecgBoot's sysDepartRole/list endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/sys/sysDepartRole/list'
        cs-uri-query|contains: 'deptId='
    condition: selection
falsepositives:
    - Legitimate cross-department role queries by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15119 - JeecgBoot Unauthorized Role Listing Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/sys/sysDepartRole/list"; http_uri; content:"deptId="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Ensure the deptId parameter is validated against the user's authorized departments.
2. Implement Authorization Checks: Add server-side checks to verify the user has access to the requested department before returning role data.
3. Rate Limiting: Limit the number of requests to the endpoint per user to prevent enumeration.

Long-Term Fix:

• Upgrade to a patched version once available (monitor JeecgBoot GitHub releases).
• Review and harden all authorization logic in the application, especially for endpoints that accept department or tenant IDs.

Workaround:

• If patching is not possible, consider disabling the endpoint or restricting access via a reverse proxy or WAF.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.