An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
##### 版本号：
2.4.5
![image](https://user-images.githubusercontent.com/15991940/125751270-42b4ea1e-4ae3-4b8c-a669-b03eca42ac19.png)

##### 问题描述：
Unauthorized access to the httptrace interface reveals sensitive information such as user cookies 

##### 截图&代码：
api interface
http://Ip:8080/jeecg-boot/actuator/httptrace/
This interface does not require any login permissions 
local demo
![image](https://user-images.githubusercontent.com/15991940/125750512-426b70f7-1f15-44bf-8f64-10ded87deb41.png)
Many jeecg-boot frameworks have such vulnerabilities, such as 
![image](https://user-images.githubusercontent.com/15991940/125752107-ca1530ba-2638-4c1a-b69c-47c0bd6f8ecc.png)

The leaked information includes client IP, browser useragent, cookie, token, etc. 


友情提示： 未按格式要求发帖，会直接删掉。

[security issue]  The jeecg-boot version is less than or equal to 2.4.5 httptrace interface has unauthorized access and leaks sensitive information such as user cookies 
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : [security issue]  The jeecg-boot version is less than or equal to 2.4.5 httptrace interface has unauthorized access and leaks sensitive information such as user cookies 
Issue date:

--- start body ---
##### 版本号：
2.4.5
![image](https://user-images.githubusercontent.com/15991940/125751270-42b4ea1e-4ae3-4b8c-a669-b03eca42ac19.png)

##### 问题描述：
Unauthorized access to the httptrace interface reveals sensitive information such as user cookies 

##### 截图&代码：
api interface
http://Ip:8080/jeecg-boot/actuator/httptrace/
This interface does not require any login permissions 
local demo
![image](https://user-images.githubusercontent.com/15991940/125750512-426b70f7-1f15-44bf-8f64-10ded87deb41.png)
Many jeecg-boot frameworks have such vulnerabilities, such as 
![image](https://user-images.githubusercontent.com/15991940/125752107-ca1530ba-2638-4c1a-b69c-47c0bd6f8ecc.png)

The leaked information includes client IP, browser useragent, cookie, token, etc. 


友情提示： 未按格式要求发帖，会直接删掉。

--- end body ---
