External risk intelligence

Jeecg Boot Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-43028

Jeecg Boot is a web application framework. The vulnerability exists within a specific report-handling component (/jmreport/show) that processes HTTP requests. As a web-based reporting component, this endpoint is commonly deployed as an internet-facing or intranet-facing web interface, making it likely to be reachable in real-world web application deployments.

Command Injection

Jeecg Boot

3.0 to 3.5.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A command injection vulnerability exists in a reporting component within the Jeecg Boot framework, potentially allowing attackers to execute arbitrary code. This issue arises from how the affected component processes certain HTTP requests.

Attackers can run their own code.
This could compromise sensitive systems.
Confirm if your Jeecg Boot usage is impacted.

Attack Path

How an attacker could exploit the issue

An attacker can reach a reporting function exposed by the Jeecg Boot framework over the network. By sending a specially crafted HTTP request to this function, an attacker can trick the system into running arbitrary commands. This could allow an attacker to take control of the server.

No authentication or user interaction needed.
Triggered by sending a malicious HTTP request.
Enables arbitrary code execution and server compromise.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in a reporting component of Jeecg Boot could allow an unauthenticated attacker to execute arbitrary code on the server by sending a specially crafted HTTP request. This could affect the integrity and availability of the affected application and its underlying system when the component is exposed.

Server-side code execution.
Via crafted HTTP requests to a reporting component.
Compromise of application and system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the Jeecg Boot framework's reporting component, likely managed by application owners or platform teams responsible for web services. The first practical step is to identify all instances of Jeecg Boot within your environment, confirm their exposure and business criticality, and then ascertain the accountable owner for remediation.

Identify affected Jeecg Boot instances.
Verify exposure and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Jeecg Boot?

Jeecg Boot is an open-source, low-code enterprise web application development framework. It provides developers with a foundation to build, deploy, and manage complex business systems efficiently. The framework includes various built-in modules, such as reporting tools, which help teams visualize and manage data within their software environments.

What does CVE-2024-43028 mean for system security?

This CVE describes a command injection vulnerability, classified as CWE-77. It occurs when a software component improperly cleans input, allowing an attacker to inject their own operating system commands. In the context of Jeecg Boot, this weakness lets a malicious actor run unauthorized code on the server hosting the application.

How is this Jeecg Boot vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted HTTP request to the /jmreport/show endpoint. It is important to note that the system does not require any prior authentication or user interaction to be affected. Simply reaching this specific reporting component with a malicious payload is sufficient to execute the unauthorized commands.

Is my Jeecg Boot instance at risk?

Halo Surface Signal indicates that because Jeecg Boot functions as a web-based framework, the reporting component is often reachable via web interfaces. If your instance is deployed where it can receive network traffic—whether across the public internet or an internal network—it is considered reachable and should be treated as potentially vulnerable.

What should I do to secure my environment?

Start by performing an inventory to locate all active Jeecg Boot instances within your infrastructure. Once identified, evaluate the business criticality of those specific services. Coordinate with the designated system owners to verify their current version and determine the necessary steps to isolate or update the affected reporting component.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.