CVE-2024-3325: JasperReports Server Privilege Escalation

CVE-2024-3325 Overview

CVE-2024-3325 is a privilege management vulnerability [CWE-269] affecting Jaspersoft JasperReports Server versions 8.0.4 through 9.0.0. The flaw allows an authenticated attacker with elevated privileges to abuse improper privilege handling within the server. Jaspersoft published a security advisory on July 9, 2024, and the CVE was disclosed publicly the following day.

The issue targets a widely deployed enterprise reporting platform used to render, schedule, and distribute business intelligence content. Successful exploitation impacts confidentiality, integrity, and availability of the reporting server.

Critical Impact
Authenticated attackers with high privileges can compromise Jaspersoft JasperReports Server integrity, confidentiality, and availability over the network.

Affected Products

Jaspersoft JasperReports Server 8.0.4 through 9.0.0
JasperReports Server 8.2.0
JasperReports Server 9.0.0

Discovery Timeline

2024-07-10 - CVE-2024-3325 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3325

Vulnerability Analysis

CVE-2024-3325 is classified under [CWE-269] Improper Privilege Management. The vulnerability resides in how JasperReports Server handles privilege assignment and enforcement across authenticated sessions. An attacker with existing high-level access on the server can leverage the weakness to perform actions that should require additional authorization boundaries.

Because JasperReports Server exposes administrative and reporting functions over HTTP, exploitation is network-reachable. No user interaction is required once the attacker holds valid credentials. The advisory from Jaspersoft confirms the affected version range spans multiple major releases, indicating the privilege management defect persisted through several product lifecycles.

Successful exploitation compromises confidentiality, integrity, and availability of the reporting server. Attackers can access sensitive report data, tamper with scheduled jobs, and disrupt reporting workflows that downstream business processes depend on.

Root Cause

The root cause is improper privilege management within JasperReports Server. Authorization checks fail to correctly constrain privileged operations, allowing a caller to perform actions outside their intended scope. Vendor documentation attributes the defect to the server's internal privilege handling logic.

Attack Vector

The attack vector is network-based against the JasperReports Server HTTP interface. The attacker must already hold high-privilege credentials on the target server. Once authenticated, the attacker issues crafted requests that exercise the flawed privilege checks. See the Jaspersoft Security Advisory CVE-2024-3325 for vendor technical detail.

No public proof-of-concept or exploit code has been published for this vulnerability.

Detection Methods for CVE-2024-3325

Indicators of Compromise

Unexpected role or permission changes on JasperReports Server user accounts
Administrative API calls originating from accounts that historically only executed report jobs
New scheduled reports, data source definitions, or repository items created outside of normal change windows
Authentication events from privileged accounts followed by rapid configuration or user management operations

Detection Strategies

Enable audit logging in JasperReports Server and forward events to a centralized SIEM for correlation
Baseline normal privileged activity per administrative account and alert on deviations
Monitor HTTP request patterns to /jasperserver/rest_v2/ endpoints for anomalous privilege-related calls
Correlate JasperReports Server audit events with endpoint telemetry from the underlying host

Monitoring Recommendations

Track all changes to roles, users, and organization objects in the JasperReports Server repository
Alert on report execution against sensitive data sources by newly privileged accounts
Review web server access logs for administrative endpoint access outside approved source IP ranges
Retain JasperReports Server audit logs for at least 90 days to support incident investigation

How to Mitigate CVE-2024-3325

Immediate Actions Required

Inventory all JasperReports Server instances and identify versions between 8.0.4 and 9.0.0
Apply the fixed release referenced in the Jaspersoft Security Advisory CVE-2024-3325
Rotate credentials for all administrative and superuser accounts on affected servers
Review audit logs since deployment for signs of privilege abuse

Patch Information

Jaspersoft published a security advisory on July 9, 2024, providing fixed builds and remediation guidance for CVE-2024-3325. Customers should consult the Jaspersoft Security Advisory CVE-2024-3325 for the exact patched version applicable to their deployment channel. Cloud-hosted Jaspersoft tenants should confirm with the vendor that fixes have been rolled out.

Workarounds

Restrict network access to JasperReports Server administrative endpoints using firewalls or reverse proxy allowlists
Enforce least privilege by reducing the number of accounts granted the ROLE_SUPERUSER or organization administrator roles
Require multi-factor authentication for all privileged JasperReports Server accounts through the upstream identity provider
Isolate JasperReports Server instances from internet exposure until patching is complete

bash

# Example: restrict access to JasperReports admin endpoints at the reverse proxy
location /jasperserver/rest_v2/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://jasperserver_backend;
}