CVE-2025-15124

Executive Summary

CVE-2025-15124 is an improper authorization vulnerability in JeecgBoot up to version 3.9.0. The flaw resides in the /sys/sysDepartPermission/list endpoint, where the departId parameter is not properly validated, allowing an authenticated attacker to enumerate department permissions. The attack complexity is high, and exploitability is difficult, but a public proof-of-concept exists. The vendor has not responded to disclosure attempts, leaving the vulnerability unpatched. The CVSS score is 3.1 (Low), but the risk is elevated due to the public exploit and potential for information disclosure.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the JeecgBoot Java framework. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – requires specific conditions or chaining
• Privileges Required: Low (PR:L) – attacker needs a valid user account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited information disclosure
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low, but with a public exploit, the risk of targeted attacks increases. The vulnerability allows an attacker to enumerate department permissions, potentially revealing sensitive organizational structures.

Deep Dive & Mechanics

The vulnerability is a classic improper authorization (CWE-285) in the getParameterMap function of the /sys/sysDepartPermission/list endpoint. The application fails to verify that the requesting user has the right to view permissions for the specified departId. An attacker with a low-privileged account can manipulate the departId parameter to list permissions for departments they should not have access to.

Root Cause: The endpoint does not enforce a server-side authorization check against the departId parameter. The application likely relies on client-side or incomplete checks, allowing an attacker to iterate through department IDs and extract permission data.

Attack Flow:

1. Attacker authenticates as a low-privileged user.
2. Attacker sends a GET request to /sys/sysDepartPermission/list?departId=<target_department_id>.
3. The server returns the permission list for that department without verifying the user's authorization.
4. Attacker can brute-force or enumerate department IDs to map the entire permission structure.

Vulnerable vs. Patched Code

Vulnerable Code (JeecgBoot <= 3.9.0): The vulnerable endpoint likely lacks an authorization check. A simplified example:

@GetMapping("/sys/sysDepartPermission/list")
public Result<List<SysDepartPermission>> list(String departId) {
    List<SysDepartPermission> list = sysDepartPermissionService.list(departId);
    return Result.ok(list);
}

Patched Code (Hypothetical): A patched version would include an authorization check:

@GetMapping("/sys/sysDepartPermission/list")
public Result<List<SysDepartPermission>> list(String departId) {
    // Verify the current user has permission to view this department
    if (!userService.hasDepartmentAccess(currentUser(), departId)) {
        return Result.error("Access denied");
    }
    List<SysDepartPermission> list = sysDepartPermissionService.list(departId);
    return Result.ok(list);
}

Note: No official patch is available as the vendor has not responded.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid low-privileged user credentials for a JeecgBoot instance.
• Network access to the target application.

Exploitation Steps:

1. Authenticate and obtain a session token.
2. Use a tool like curl or Burp Suite to enumerate department IDs:

   curl -X GET "http://target.com/sys/sysDepartPermission/list?departId=1" \
        -H "Cookie: JSESSIONID=your_session_id"
   

3. Iterate through department IDs (e.g., 1, 2, 3, ...) to collect permission data.
4. Analyze the response to understand the permission structure.

Example Output:

{
  "code": 200,
  "data": [
    {"departId": "1", "permission": "admin:view"},
    {"departId": "1", "permission": "admin:edit"}
  ]
}

Blue Team (Detection & Defense)

Detection:

• Monitor for repeated requests to /sys/sysDepartPermission/list with varying departId parameters from the same user.
• Alert on unusual patterns of department ID enumeration (e.g., sequential IDs).

Defense:

• Implement server-side authorization checks for all endpoints.
• Apply rate limiting to sensitive endpoints.
• Use Web Application Firewall (WAF) rules to block suspicious patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Repeated GET requests to /sys/sysDepartPermission/list with sequential or brute-forced departId values.
  • Unusual HTTP 200 responses containing permission data for multiple departments.

• Log IOCs:

  • Access logs showing multiple requests to the vulnerable endpoint from the same user within a short time frame.
  • Error logs indicating failed authorization attempts (if any).

• File IOCs:

  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_15124_JeecgBoot_Authorization {
    meta:
        description = "Detects exploitation attempts for CVE-2025-15124 in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15124"
    strings:
        $s1 = "/sys/sysDepartPermission/list" ascii wide nocase
        $s2 = "departId=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-15124 - JeecgBoot Improper Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit improper authorization in JeecgBoot /sys/sysDepartPermission/list
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/sys/sysDepartPermission/list'
        cs-uri-query|contains: 'departId='
    condition: selection
falsepositives:
    - Legitimate administrative use
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15124 - JeecgBoot Improper Authorization Attempt"; flow:to_server; content:"GET"; http_method; content:"/sys/sysDepartPermission/list"; http_uri; content:"departId="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Ensure the departId parameter is validated against the user's authorized departments.
2. Implement Authorization Checks: Add server-side checks to verify the user has permission to view the requested department's permissions.
3. Rate Limiting: Limit the number of requests to the vulnerable endpoint per user.
4. Monitor Logs: Actively monitor for exploitation attempts.

Long-Term Fix:

• Since no official patch is available, consider forking the repository and applying the fix manually.
• Upgrade to a patched version once released by the vendor.

Workarounds:

• Use a WAF to block requests with suspicious departId patterns.
• Disable the endpoint if not required.

Valters IT
DevSecOps & Cyber Threat Intelligence