If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.
Spring Security:
Spring Security 6.x and earlier are not affected; the described issue applies to XML intercept-url servlet path handling in Spring Security 7.
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 7.0.x | 7.0.5 | OSS |
If you are not able to upgrade, you can place the servlet path directly in the URL as follows:
<sec:intercept-url pattern="/servlet-path/endpoint/**" access="authenticated"/>
Use an access expression (or other supported authorization attributes) appropriate for your application.
The issue was identified and responsibly reported by Apex, a Cantinas AppSec agent.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。