Attack Chain

1. The attacker performs reconnaissance on the target JimuReport instance to locate the report template folder listing endpoint.
2. The attacker sends an unauthenticated HTTP request to the vulnerable endpoint.
3. The application fails to validate the user's authentication status and returns a listing of reports along with their corresponding share tokens.
4. The attacker parses the response to extract the target share tokens.
5. The attacker uses a retrieved share token to perform a subsequent request against protected report endpoints.
6. The application validates the share token as a legitimate access mechanism for the requested report.
7. The application returns the full report definition, exposing underlying database structures and query data to the attacker.

Impact

Successful exploitation allows for the unauthorized retrieval of sensitive business intelligence, including embedded SQL statements, database schema details, and live data retrieved by the reports. This leads to information disclosure which could facilitate further attacks against backend database infrastructure. There are no currently observed victim counts, but the vulnerability affects all deployments running version 2.3.4 or earlier.

Recommendation

• Update JimuReport to a patched version immediately as referenced in the JeecgBoot project issues.
• Audit access logs for anomalous, high-frequency requests to report template listing endpoints from unauthenticated sources.
• Monitor webserver logs for unauthorized attempts to access report endpoints using share tokens that were not previously distributed to authorized users.