JEEWMS issue2: `updateAuthority` 可改写角色功能权限-三亩地-编程学习日记

Vulnerability call chain

1.1 Summary

JEEWMS has a missing authorization vulnerability: updateAuthority 可改写角色功能权限. 可给角色授予或移除菜单/功能权限，影响用户后续可访问功能和授权状态。

Attack precondition: 攻击者能访问 roleController.do?updateAuthority。源码层面未证明该入口仅系统管理员可访问。
Security impact: 可给角色授予或移除菜单/功能权限，影响用户后续可访问功能和授权状态。

1.2 Exploit path

提交任意 roleId 和 rolefunctions，服务端删除该角色旧功能绑定并新增请求中的功能绑定。

1.3 Key code evidence

src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java

Evidence location: https://gitee.com/erzhongxmu/JEEWMS/blob/master/src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java#L580

  577  	 * @param request578  	 * @return579  	 */580  	@RequestMapping(params = "updateAuthority")581  	@ResponseBody582  	public AjaxJson updateAuthority(HttpServletRequest request) {583  		AjaxJson j = new AjaxJson();

security-reports/pure_fix_code/src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java

Evidence location: https://gitee.com/erzhongxmu/JEEWMS/blob/master/security-reports/pure_fix_code/src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java#L585

  582  	@ResponseBody583  	public AjaxJson updateAuthority(HttpServletRequest request) {584  		AjaxJson j = new AjaxJson();585  		try {586  			String roleId = request.getParameter("roleId");587  			String rolefunction = request.getParameter("rolefunctions");588  			String scopeMessage = validateRoleAuthorityScope(roleId, rolefunction);589  			if (scopeMessage != null) {590  				j.setSuccess(false);

security-reports/pure_fix_code/src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java

Evidence location: https://gitee.com/erzhongxmu/JEEWMS/blob/master/security-reports/pure_fix_code/src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java#L595

  592  				return j;593  			}594  			TSRole role = this.systemService.get(TSRole.class, roleId);595  			List<TSRoleFunction> roleFunctionList = systemService596  					.findByProperty(TSRoleFunction.class, "TSRole.id",597  							role.getId());598  			Map<String, TSRoleFunction> map = new HashMap<String, TSRoleFunction>(1024);599  			for (TSRoleFunction functionOfRole : roleFunctionList) {600  				map.put(functionOfRole.getTSFunction().getId(), functionOfRole);601  			}602  			String[] roleFunctions = rolefunction.split(",");603  			Set<String> set = new HashSet<String>();

security-reports/pure_fix_code/src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java

Evidence location: https://gitee.com/erzhongxmu/JEEWMS/blob/master/security-reports/pure_fix_code/src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java#L627

  624  		}625  		if (!helper.canManageRole(currentUser, roleId)) {626  			return "没有权限操作该角色！";627  		}628  		for (String functionId : helper.parseIds(functionIds)) {629  			if (!helper.currentUserHasFunction(currentUser, functionId)) {630  				return "没有权限授予该功能！";631  			}632  		}633  		return null;634  	}

security-reports/pure_fix_code/src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java

Evidence location: https://gitee.com/erzhongxmu/JEEWMS/blob/master/security-reports/pure_fix_code/src/main/java/org/jeecgframework/web/system/controller/core/RoleController.java#L639

  636  	/**637  	 * 权限比较638  	 * 639  	 * @param set640  	 *            最新的权限列表641  	 * @param role642  	 *            当前角色643  	 * @param map

3. Root Cause Analysis

Root Cause 1: Missing server-side authorization on the vulnerable operation.

The endpoint accepts user-controlled authorization-sensitive identifiers or fields, but the write/read path does not prove that the current caller may operate on the target object.

Root Cause 2: Missing object-scope or grant-bound validation.

The implementation relies on endpoint access, UI filtering, or object existence checks instead of enforcing target ownership, tenant boundary, role ceiling, or grantable-resource constraints at the service layer.

4. Recommended fix

将该接口强制限制为系统管理员或明确的角色管理权限；校验当前用户可管理目标角色，且只能授予自己权限范围内的功能。

5. Verification after fix

Unauthorized callers receive HTTP 403 or equivalent rejection.
Out-of-scope target identifiers are rejected before database writes or sensitive reads.
Role, permission, tenant, organization, ownership, or grant-bound ceilings are enforced server-side.
Direct HTTP requests are rejected even when front-end controls are hidden.

日记详情

JEEWMS issue2: `updateAuthority` 可改写角色功能权限