Spring Security GHSA-4x7m-7374-3636: Authorization Bypass via Fuzzy Method Name Matching in @PreAuthorize

Vulnerability Summary: Bypass of Ajax Method Name Convention in Spring Security Vulnerability Overview Vulnerability ID: GHSA-4x7m-7374-3636 Vulnerability Type: Authorization Bypass Affected Components: Spring Security's annotation and Ajax method name convention mechanism Root Cause: - Spring Security performs fuzzy matching on method names when parsing expressions. - Attackers can construct variants such as , , or to bypass authorization checks. - This behavior stems from the lenient method name resolution strategy of the SpEL expression engine. Scope of Impact Affected Versions: - Spring Security 5.0.0 to 5.7.x (partial versions) - Spring Security 6.0.0 to 6.1.x (partial versions) Affected Methods: - All controller methods using that rely on method name conventions (e.g., , ). - Particularly methods invoked via Ajax requests (e.g., mapped to ). Impact Scenarios: - Users can bypass access controls and execute unauthorized operations by modifying request parameters or using method name variants. - For example: can be changed to or to bypass authorization. Remediation Official Patched Versions: - Spring Security 5.7.14+ - Spring Security 6.1.1+ Fix Details: - Strictly restrict method name matching rules within expressions, prohibiting fuzzy matching. - Only allow exact method name matches (e.g., ); variants like or are no longer accepted. Temporary Mitigation Measures: - Explicitly specify concrete permission expressions on controller methods, such as , avoiding reliance on method name conventions. - Use stricter annotations like or as alternatives to method name conventions. POC / Exploitation Code > Note: Actual exploitation depends on the specific application context, but the core principle involves bypassing authorization validation by exploiting fuzzy method name matching.

Goal Reached Thanks to every supporter — we hit 100%!

Spring Security GHSA-4x7m-7374-3636: Authorization Bypass via Fuzzy Method Name Matching in @PreAuthorize

More from this source