Vulnerability in Exrick xboot

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile numbers, emails and status.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/bas…
• github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/bas…
• hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure
• www.vulncheck.com/advisories/xboot-through-3.3.4-authorization-bypass-via-getbydepartme…