Authentication Bypass in JimuReport

JimuReport versions 2.3.4 and earlier are susceptible to an authentication bypass vulnerability located within the report folder template listing endpoint. This vulnerability enables unauthenticated remote attackers to enumerate report objects and retrieve associated share tokens. By obtaining these tokens, an attacker can bypass authorization controls on protected report endpoints to access full report definitions. This access is significant because report definitions within JimuReport often contain sensitive information, including hardcoded SQL statements, database connection logic, and live query results from connected backend data sources. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function).

Attack Chain

1. The attacker performs reconnaissance on the target JimuReport instance to locate the report template folder listing endpoint.
2. The attacker sends an unauthenticated HTTP request to the vulnerable endpoint.
3. The application fails to validate the user's authentication status and returns a listing of reports along with their corresponding share tokens.
4. The attacker parses the response to extract the target share tokens.
5. The attacker uses a retrieved share token to perform a subsequent request against protected report endpoints.
6. The application validates the share token as a legitimate access mechanism for the requested report.
7. The application returns the full report definition, exposing underlying database structures and query data to the attacker.

Impact

Successful exploitation allows for the unauthorized retrieval of sensitive business intelligence, including embedded SQL statements, database schema details, and live data retrieved by the reports. This leads to information disclosure which could facilitate further attacks against backend database infrastructure. There are no currently observed victim counts, but the vulnerability affects all deployments running version 2.3.4 or earlier.

Recommendation

• Update JimuReport to a patched version immediately as referenced in the JeecgBoot project issues.
• Audit access logs for anomalous, high-frequency requests to report template listing endpoints from unauthenticated sources.
• Monitor webserver logs for unauthorized attempts to access report endpoints using share tokens that were not previously distributed to authorized users.