JeecgBoot Improper Authorization Vulnerability in Role Export Function

A vulnerability allowing improper authorization has been identified in JeecgBoot versions through 3.8.2. The issue resides in the '/sys/role/exportXls' endpoint, which can be accessed remotely without proper authorization checks. This vulnerability allows authenticated users to export all system roles, including sensitive details such as role names, codes, and descriptions.

Impact

Exploitation of this vulnerability enables unauthorized role data access, which could be used for information gathering, privilege escalation, or security reconnaissance.

Reproduction

To reproduce this vulnerability, authenticate as a user with low privileges and send a GET request to the '/sys/role/exportXls' endpoint. The response will include an Excel file containing all system roles.