CVE-2025-15121
📋 TL;DR
This vulnerability in JeecgBoot allows attackers to exploit the getDeptRoleByUserId function by manipulating the departId parameter, leading to unauthorized information disclosure. It affects JeecgBoot versions up to 3.9.0. Organizations using vulnerable versions of this Java-based rapid development platform are at risk.
💻 Affected Systems
- JeecgBoot
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive department role information for all users, potentially revealing organizational structure and access privileges.
Likely Case
Limited information disclosure about department roles and user assignments, which could aid in further attacks.
If Mitigated
Minimal impact with proper input validation and access controls in place.
🎯 Exploit Status
Exploitation requires sending manipulated departId parameter to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Monitor JeecgBoot GitHub repository for updates. 2. Apply patch when available. 3. Restart application server.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation for departId parameter to prevent manipulation.
Implement parameter validation in controller layer
Endpoint Restriction
allRestrict access to /sys/sysDepartRole/getDeptRoleByUserId endpoint.
Configure web.xml or Spring Security to restrict endpoint access
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block suspicious parameter manipulation
- Monitor access logs for unusual requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Test if manipulating departId parameter in requests to /sys/sysDepartRole/getDeptRoleByUserId returns unauthorized information.Check Version:
Check pom.xml for jeecg-boot version or application.properties for version information.Verify Fix Applied:
Verify parameter manipulation no longer returns sensitive information and proper input validation is enforced.📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in departId field
- Multiple requests to /sys/sysDepartRole/getDeptRoleByUserId with varying parameters
Network Indicators:
- HTTP requests with manipulated departId parameters
SIEM Query:
source="web_server" AND uri="/sys/sysDepartRole/getDeptRoleByUserId" AND (param.departId CONTAINS suspicious_pattern)