CVE-2025-45618: Jeeweb-mybatis-springboot Access Control Flaw

CVE-2025-45618 Overview

CVE-2025-45618 is an incorrect access control vulnerability in jeeweb-mybatis-springboot v0.0.1.RELEASE, an open-source Java web application framework built on Spring Boot and MyBatis. The flaw resides in the /admin/sys/datasource/ajaxList endpoint, which fails to enforce proper authorization checks. Authenticated attackers with low privileges can send a crafted request to this endpoint and retrieve sensitive datasource information, including database connection details. The vulnerability is classified under CWE-284: Improper Access Control.

Critical Impact
Low-privileged authenticated attackers can access sensitive datasource configuration data through the vulnerable admin endpoint, exposing backend database connection information.

Affected Products

huangjian888 jeeweb-mybatis-springboot v0.0.1.RELEASE
CPE: cpe:2.3:a:huangjian888:jeeweb-mybatis-springboot:0.0.1:*:*:*:*:*:*:*
Component: /admin/sys/datasource/ajaxList

Discovery Timeline

2025-05-05 - CVE-2025-45618 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-45618

Vulnerability Analysis

The vulnerability affects the datasource management interface in the jeeweb-mybatis-springboot administrative backend. The /admin/sys/datasource/ajaxList endpoint returns a list of configured datasources but does not properly validate whether the requesting user holds the required administrative role. Any authenticated user with low-level privileges can invoke this endpoint and obtain configuration details intended for administrators only.

The response typically includes datasource identifiers, JDBC connection URLs, driver classes, and other metadata used to configure database connectivity. Exposure of this data enables reconnaissance against backend databases and can support follow-on attacks such as credential brute-forcing or direct database access if network paths are reachable.

Root Cause

The root cause is missing or insufficient role-based access control (RBAC) on a sensitive administrative endpoint. The controller mapped to /admin/sys/datasource/ajaxList authenticates the session but does not authorize the specific role required to list datasources. This mismatch between authentication and authorization is a common pattern flagged under CWE-284.

Attack Vector

Exploitation requires network access to the application and a valid low-privilege account. The attacker sends an HTTP request to the /admin/sys/datasource/ajaxList path with the crafted parameters expected by the AJAX handler. The server returns the datasource list without enforcing administrator-level authorization. No user interaction is required beyond the initial authenticated request.

Refer to the GitHub Issue Discussion for technical context on the affected endpoint.

Detection Methods for CVE-2025-45618

Indicators of Compromise

HTTP requests to /admin/sys/datasource/ajaxList originating from non-administrative user sessions.
Unusual volume of AJAX list requests to /admin/sys/* endpoints from a single authenticated account.
Application logs showing successful HTTP 200 responses to datasource enumeration requests by low-privilege roles.

Detection Strategies

Review web server access logs for requests to /admin/sys/datasource/ajaxList and correlate with the authenticated user's role assignment.
Enable application-level audit logging for all /admin/sys/* endpoints and alert on access by non-admin accounts.
Deploy a web application firewall (WAF) rule that blocks or flags requests to datasource management endpoints from sessions lacking administrator claims.

Monitoring Recommendations

Baseline normal access patterns for administrative endpoints and alert on deviations by user, role, or source IP.
Forward Spring Boot application logs to a centralized SIEM for correlation with authentication and authorization events.
Monitor outbound database connections for anomalous source addresses that may indicate credential reuse following disclosure.

How to Mitigate CVE-2025-45618

Immediate Actions Required

Restrict network access to the jeeweb-mybatis-springboot administrative interface using firewall rules or reverse-proxy allow-lists.
Audit all user accounts and revoke unnecessary access to the administrative backend until a fix is applied.
Rotate database credentials referenced by datasource configurations if unauthorized access is suspected.

Patch Information

No official vendor patch has been published at the time of NVD listing. The project maintainer has been notified through the GitHub Issue Discussion. Organizations using jeeweb-mybatis-springboot v0.0.1.RELEASE should track the upstream repository for a corrective release and consider migrating to a maintained alternative if updates are not forthcoming.

Workarounds

Add a servlet filter or Spring Security rule that enforces administrator role checks on all /admin/sys/datasource/* paths.
Place the administrative interface behind a VPN or bastion host to eliminate exposure to untrusted networks.
Disable or remove unused user accounts that could be leveraged to reach the vulnerable endpoint.

bash

# Example Spring Security configuration snippet enforcing admin role on datasource endpoints
# http.authorizeRequests()
#   .antMatchers("/admin/sys/datasource/**").hasRole("ADMIN")
#   .anyRequest().authenticated();