CVE-2023-34602
📋 TL;DR
JeecgBoot versions up to 3.5.1 contain a SQL injection vulnerability in the queryTableDictItemsByCode component of the SystemApiController. This allows attackers to execute arbitrary SQL commands on the database. Organizations using vulnerable JeecgBoot installations are affected.
💻 Affected Systems
- JeecgBoot
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited; the GitHub issue shows proof of concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 3.5.1
Vendor Advisory: https://github.com/jeecgboot/jeecg-boot/issues/4983
Restart Required: Yes
Instructions:
1. Update JeecgBoot to version after 3.5.1. 2. Restart the application server. 3. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the queryTableDictItemsByCode parameter to block SQL injection attempts.
Configure application firewall rules or modify controller code to sanitize inputs.
🧯 If You Can't Patch
- Restrict network access to the JeecgBoot application to trusted IPs only.
- Implement a web application firewall (WAF) with SQL injection protection rules.
🔍 How to Verify
Check if Vulnerable:
Check JeecgBoot version; if it's 3.5.1 or earlier, it's vulnerable. Test the /api/queryTableDictItemsByCode endpoint with SQL injection payloads.Check Version:
Check the application's version in its configuration files or via admin interface.Verify Fix Applied:
After updating, test the same endpoint with SQL injection payloads to ensure they are blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs, especially with special characters like quotes or semicolons in the queryTableDictItemsByCode parameter.
Network Indicators:
- HTTP requests to /api/queryTableDictItemsByCode containing SQL keywords or suspicious patterns.
SIEM Query:
Example: search for 'queryTableDictItemsByCode' in web logs with payloads like 'OR', 'UNION', or 'SELECT'.