CVE-2021-37304
📋 TL;DR
CVE-2021-37304 is an insecure permissions vulnerability in jeecg-boot 2.4.5 that allows unauthenticated remote attackers to access the httptrace interface. This enables privilege escalation and exposure of sensitive information. Organizations using jeecg-boot 2.4.5 with the httptrace endpoint exposed are affected.
💻 Affected Systems
- jeecg-boot
📦 What is this software?
Jeecg by Jeecg
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative privileges, access all system data, and potentially pivot to other systems in the network.
Likely Case
Unauthenticated attackers access sensitive system information and user data through the httptrace interface.
If Mitigated
Attackers are blocked from accessing the vulnerable endpoint through proper network controls and authentication.
🎯 Exploit Status
Exploitation requires only HTTP requests to the vulnerable endpoint without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.6 and later
Vendor Advisory: https://github.com/jeecgboot/jeecg-boot/issues/2793
Restart Required: Yes
Instructions:
1. Upgrade jeecg-boot to version 2.4.6 or later. 2. Restart the application server. 3. Verify the httptrace endpoint is no longer accessible without authentication.
🔧 Temporary Workarounds
Disable httptrace endpoint
allConfigure jeecg-boot to disable the httptrace interface entirely.
Set management.trace.http.enabled=false in application.properties
Restrict network access
linuxUse firewall rules to block external access to the httptrace endpoint.
iptables -A INPUT -p tcp --dport [jeecg-port] -m string --string "httptrace" --algo bm -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate jeecg-boot instances from untrusted networks.
- Deploy a web application firewall (WAF) with rules to block requests to httptrace endpoints.
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to /actuator/httptrace endpoint without authentication. If it returns data, the system is vulnerable.Check Version:
Check jeecg-boot version in application startup logs or via /actuator/info endpoint if available.Verify Fix Applied:
Attempt to access /actuator/httptrace without authentication after patching. It should return 401 Unauthorized or 404 Not Found.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to /actuator/httptrace in access logs
- Multiple failed authentication attempts followed by httptrace access
Network Indicators:
- HTTP requests to /actuator/httptrace from untrusted IPs
- Unusual traffic patterns to actuator endpoints
SIEM Query:
source="web_logs" AND (url="/actuator/httptrace" OR url="/httptrace") AND status=200