If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application.
This can lead to the authentication, authorization, and other security controls being rendered inactive on intended requests.
If you are not using securityMatchers(String), you are not affected. Also, if you are not configuring a servlet path or are not using a PathPatternRequestMatcher.Builder bean to describe the servlet path, you are not affected.
If you are using Spring Boot, it may not be readily apparent to you if you are using a PathPatternRequestMatcher.Builder bean to prepend a servlet path.
One common way to determine this is by looking for the Spring Boot property spring.mvc.servlet.path in your application; it may have a value like /api or /mvc.
Spring Security:
Spring Security 6.x and earlier are not affected; the described interaction involves Spring Security 7's integration between string-based matchers and a published PathPatternRequestMatcher.Builder bean.
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 7.0.x | 7.0.5 | OSS |
If you are not able to upgrade, you can place the servlet path directly in the matcher pattern as follows:
http
.securityMatchers("/servlet-path/admin/**")
// ...
The issue was identified and responsibly reported by Apex, a Cantinas AppSec agent.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。