CVE-2024-12347
📋 TL;DR
This CVE describes an improper authorization vulnerability in the Druid monitoring interface of Jeewms warehouse management software. Attackers can remotely access sensitive monitoring data without authentication. All users of Jeewms up to version 1.0.0 are affected.
💻 Affected Systems
- Guangzhou Huayi Intelligent Technology Jeewms
📦 What is this software?
Jeewms by Huayi Tec
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through exposed monitoring data revealing database credentials, configuration details, and potentially enabling further attacks.
Likely Case
Unauthorized access to sensitive monitoring information including database queries, performance metrics, and system configuration.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to monitoring interface.
🎯 Exploit Status
Exploit details have been publicly disclosed and require only web browser access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider workarounds or alternative software.
🔧 Temporary Workarounds
Block Druid Monitoring Interface
allRestrict access to the vulnerable Druid monitoring endpoint using web server configuration or firewall rules.
# Apache: RewriteRule ^/jeewms_war/webpage/system/druid/ - [F,L]
# Nginx: location ~ ^/jeewms_war/webpage/system/druid/ { deny all; }
# Firewall: iptables -A INPUT -p tcp --dport [port] -m string --string "/jeewms_war/webpage/system/druid/" --algo bm -j DROP
Disable Druid Monitoring
linuxRemove or disable the Druid monitoring component from Jeewms deployment.
# Remove Druid files: rm -rf /path/to/jeewms/webpage/system/druid/
# Or rename directory: mv /path/to/jeewms/webpage/system/druid/ /path/to/jeewms/webpage/system/druid_disabled/
🧯 If You Can't Patch
- Implement strict network access controls to limit access to Jeewms interface to authorized users only.
- Deploy web application firewall (WAF) with rules to block access to Druid monitoring paths.
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[jeewms-host]:[port]/jeewms_war/webpage/system/druid/index.html without authentication. If accessible, system is vulnerable.Check Version:
Check Jeewms version in application interface or configuration files. Default location may vary by installation.Verify Fix Applied:
Verify the Druid monitoring interface is no longer accessible without proper authentication or returns 403/404 error.📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to /jeewms_war/webpage/system/druid/ paths from unauthenticated users
- Unusual access patterns to Druid monitoring interface
Network Indicators:
- HTTP GET requests to Druid monitoring endpoints without preceding authentication requests
SIEM Query:
source="web_server" AND (url_path="/jeewms_war/webpage/system/druid/" OR url_path CONTAINS "druid") AND response_code=200 AND NOT user_agent="health_check"