Executive brief
JeeWMS, a warehouse management system, contains a security flaw where sensitive internal diagnostic tools are accessible to anyone on the internet without a password. An attacker can use these tools to download the system's memory or view configuration details, which often contain passwords, secret keys, and customer data. This information could be used to take over the system or gain unauthorized access to the company's private database.
Technical details
JeeWMS (up to commit 141740a) suffers from improper access control in its ShiroConfig, which explicitly allows anonymous access to the '/base-boot/actuator/**' path. This exposes sensitive Spring Boot Actuator endpoints, specifically '/env' and '/heapdump', to unauthenticated remote attackers. An attacker can exploit this to retrieve environment variables, database credentials, and full JVM heap dumps. Analysis of these dumps can reveal in-memory secrets such as JWTs, session tokens, and API keys, potentially leading to full system compromise. As of the advisory date, the vendor has not responded to disclosure attempts.
Affected products
- erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69
Timeline
- 2026-05-13: disclosed: Issue reported on GitHub by researcher
- 2026-06-07: advisory: NVD/VulDB publication date