CVE-2025-15125

Executive Summary

CVE-2025-15125 is an improper authorization vulnerability (CWE-285) discovered in JeecgBoot, an open-source Java rapid development platform. The flaw resides in the /sys/permission/queryDepartPermission endpoint, where the departId parameter is not properly validated. An authenticated attacker with low privileges can exploit this by manipulating the departId argument to query department permissions they should not have access to. The attack complexity is high, and the exploit has been publicly released. The vendor was contacted but has not responded, leaving the vulnerability unpatched as of version 3.9.0.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): High – Exploitation requires specific conditions or knowledge.
• Privileges Required (PR): Low – The attacker needs valid low-privilege credentials.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited information disclosure (department permissions).
• Integrity (I): None – No data modification.
• Availability (A): None – No impact on system availability.

Threat Level: Low. The high attack complexity and requirement for authentication reduce the immediate risk, but the public availability of exploit code increases the potential for targeted attacks.

Deep Dive & Mechanics

The vulnerability is an improper authorization check in the queryDepartPermission function. The endpoint /sys/permission/queryDepartPermission is designed to return permissions associated with a specific department. The departId parameter is used to identify which department's permissions to retrieve.

Root Cause: The application fails to verify that the authenticated user has the right to access permissions for the provided departId. This allows a low-privilege user to enumerate permissions of other departments by simply changing the departId value.

Attack Flow:

1. An attacker authenticates as a low-privilege user.
2. The attacker sends a GET request to /sys/permission/queryDepartPermission?departId=<target_department_id>.
3. The server processes the request without checking if the user belongs to or has rights to the target department.
4. The server returns the permission data for the target department, leading to information disclosure.

Impact: An attacker can map out the permission structure of the entire organization, potentially identifying high-privilege accounts or sensitive resources.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the queryDepartPermission method. A patched version would include an authorization check.

Vulnerable Code (Conceptual):

// Vulnerable: No authorization check
@RequestMapping("/sys/permission/queryDepartPermission")
public Result queryDepartPermission(@RequestParam String departId) {
    // Directly query and return permissions for the given departId
    List<Permission> permissions = permissionService.queryByDepartId(departId);
    return Result.ok(permissions);
}

Patched Code (Conceptual):

// Patched: Authorization check added
@RequestMapping("/sys/permission/queryDepartPermission")
public Result queryDepartPermission(@RequestParam String departId) {
    // Verify the current user has access to the department
    if (!userService.userHasAccessToDepartment(getCurrentUserId(), departId)) {
        return Result.error("Access denied");
    }
    List<Permission> permissions = permissionService.queryByDepartId(departId);
    return Result.ok(permissions);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of JeecgBoot <= 3.9.0.
• Valid low-privilege credentials (e.g., username: user, password: password).

Exploitation Steps:

1. Authenticate and obtain a session token.
2. Use a tool like curl to send a request with a manipulated departId:

   curl -X GET "http://target.com/sys/permission/queryDepartPermission?departId=2" \
        -H "Cookie: JSESSIONID=your_session_id"
   

3. Observe the response containing permissions for department ID 2.
4. Iterate through department IDs to enumerate all permissions.

Example Output:

{
  "success": true,
  "message": "success",
  "data": [
    {
      "id": "123",
      "name": "Admin Panel",
      "url": "/admin",
      "perms": "admin:panel"
    }
  ]
}

Blue Team

Detection:

• Monitor for repeated requests to /sys/permission/queryDepartPermission with varying departId parameters from the same user.
• Look for anomalous access patterns, such as a low-privilege user querying multiple department IDs.

Hunting:

• Search logs for the endpoint /sys/permission/queryDepartPermission and correlate with user roles.
• Use the following Splunk query:

  index=web_logs uri="/sys/permission/queryDepartPermission*" 
  | stats count by user, departId
  | where count > 5
  

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /sys/permission/queryDepartPermission with a departId parameter.
  • Multiple requests from the same IP address with different departId values.
• Logs:
  • Access logs showing the endpoint /sys/permission/queryDepartPermission from low-privilege users.
  • Error logs indicating failed authorization attempts (if any).
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_15125_JeecgBoot_ImproperAuth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-15125 in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15125"
    strings:
        $endpoint = "/sys/permission/queryDepartPermission"
        $depart_param = "departId="
    condition:
        $endpoint and $depart_param
}

Sigma Rule

title: CVE-2025-15125 - JeecgBoot Improper Authorization
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2025-15125
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/sys/permission/queryDepartPermission"
    condition: selection
falsepositives:
    - Legitimate administrative use
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15125 - JeecgBoot Improper Authorization Attempt"; flow:to_server; content:"/sys/permission/queryDepartPermission"; http_uri; content:"departId="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Use a Web Application Firewall (WAF) to block requests to /sys/permission/queryDepartPermission from low-privilege users.
2. Monitor Logs: Actively monitor for exploitation attempts using the provided detection rules.
3. Disable Endpoint: If possible, disable the endpoint until a patch is available.

Long-term Fix:

• The vendor must implement proper authorization checks in the queryDepartPermission function.
• Apply the principle of least privilege and ensure that users can only access data for departments they belong to.

Workaround:

• Modify the application code to add an authorization check (see patched code example).

Valters IT