CVE-2023-34659
📋 TL;DR
Jeecg-Boot versions 3.5.0 and 3.5.1 contain a SQL injection vulnerability in the id parameter of the /jeecg-boot/jmreport/show interface. This allows attackers to execute arbitrary SQL commands on the database. Organizations using these vulnerable versions are affected.
💻 Affected Systems
- jeecg-boot
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation through database manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
SQL injection via GET parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.2 or later
Vendor Advisory: https://github.com/jeecgboot/jeecg-boot/issues/4976
Restart Required: Yes
Instructions:
1. Upgrade to jeecg-boot 3.5.2 or later. 2. Restart the application server. 3. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting the /jeecg-boot/jmreport/show endpoint.
Endpoint Restriction
allRestrict access to the vulnerable endpoint using network ACLs or application firewall rules.
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for the id parameter
- Deploy network segmentation to isolate the vulnerable system from critical assets
🔍 How to Verify
Check if Vulnerable:
Test the /jeecg-boot/jmreport/show endpoint with SQL injection payloads in the id parameter.Check Version:
Check application version in web interface or configuration files.Verify Fix Applied:
After patching, retest with SQL injection payloads to confirm they are properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL injection patterns
Network Indicators:
- HTTP requests to /jeecg-boot/jmreport/show with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/jeecg-boot/jmreport/show" AND (param="id" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR")