grpc-spring-boot-starter CWE-285: Vertical Privilege Escalation via OR-merged @Secured rules

Summary of Key Vulnerability Information Vulnerability Overview Title: [Security Disclosure] Vertical Privilege Escalation via OR-Merged Service/Method @Secured Authorization Rules #423 Type: CWE-285 (Improper Authorization / Incorrect Authorization) CVSS 3.1: 4.2 (Medium), vector Core Issue: When processes Spring Security’s annotations, it combines class-level and method-level rules using an OR-merge strategy. This causes callers to access methods that should be restricted to , resulting in vertical privilege escalation. Affected Scope: - Affected component: - Affected versions: - Impact: With default configurations, a can invoke methods that should be accessible only to (e.g., ), leading to privilege escalation. Remediation Change the merging of class-level and method-level rules from OR-merge to AND-merge (i.e., both the class-level and method-level rules must be satisfied for access to be granted), or provide a configuration option to control the merging strategy. In , correct the merging logic for annotations to ensure that class-level rules are not "relaxed" by method-level rules. POC / Exploitation Code (Full Extraction) 1. 2. 3. 4. 5. 6. ```java package com.poc.grpc; import com.poc.grpc.proto.AdminOnlyServiceGrpc; import com.poc.grpc.proto.Preset; import com.poc.grpc.proto.PresetGrpc; import org.junit.jupiter.api.*; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.Assertions; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.test.web.client.TestRestTemplate; @GrpcService public class VulnerabilityReproductionTest { @GrpcService private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private static final String IMG = "img/password"; private stati

Goal Reached Thanks to every supporter — we hit 100%!

grpc-spring-boot-starter CWE-285: Vertical Privilege Escalation via OR-merged @Secured rules

More from this source