CVE-2024-43028

The vulnerability is located in the /jmreport/show endpoint accessible over the network. An attacker can send a crafted HTTP request containing a malicious payload that is passed to the system command interpreter without proper validation or sanitization of input data (CWE-77 — improper neutralization of special elements used in a command). As a result, arbitrary system commands are executed with the privileges of the application process.

An attacker without any authentication can remotely execute arbitrary code on the server, leading to complete system takeover, data breach, and the ability to disrupt application functionality.

Apply patches available from the vendor according to the references. Urgent update to a version newer than v3.5.3 is recommended, and until the update is applied, restrict access to the /jmreport/show endpoint at the firewall or reverse proxy level, especially for unauthenticated users.

Jeecg Boot versions from v3.0.0 to v3.5.3