grpc-spring-boot-starter @Secured规则OR合并导致垂直权限提升

漏洞关键信息总结 漏洞概述 标题：[Security Disclosure] Vertical Privilege Escalation via OR-Merged Service/Method @Secured Authorization Rules #423 类型：CWE-285（Improper Authorization / Incorrect Authorization） CVSS 3.1：4.2（Medium），向量 核心问题： 在处理 Spring Security 的 注解时，将类级别与方法级别的 规则以 OR 合并 的方式叠加，导致本应更严格的类级 与方法级 合并后， 调用者也能通过方法级规则访问本应仅 可访问的方法，形成垂直权限提升。 影响范围： - 受影响组件： - 受影响版本： - 影响：在默认配置下， 可调用仅 可访问的方法（如 ），造成权限提升。 修复方案 将类级与方法级 规则由 OR 合并 改为 AND 合并（即同时满足类级与方法级规则才放行），或提供配置项控制合并策略。 在 中，对 注解的合并逻辑进行修正，确保类级规则不会被方法级规则"放宽"。 POC / 利用代码（完整提取） 1. 2. 3. 4. 5. 6. ```java package com.poc.grpc; import com.poc.grpc.proto.AdminOnlyServiceGrpc; import com.poc.grpc.proto.Preset; import com.poc.grpc.proto.PresetGrpc; import org.junit.jupiter.api.*; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.Assertions; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.test.web.client.TestRestTemplate; @GrpcService public class VulnerabilityReproductionTest { @GrpcService private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/passwor

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

grpc-spring-boot-starter @Secured规则OR合并导致垂直权限提升

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

grpc-spring-boot-starter @Secured规则OR合并导致垂直权限提升

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！