[GHSA-9pp5-9c7g-4r83] Spring Security authorization bypass for method security annotations on private methods

[tomabai]

Updates

• Affected products
• References

Comments
The vulnerability involves both spring-security-aspects and spring-security-core.
spring-security-aspects artifact is right to be flagged because the issue is only exploitable when that module (or @EnableMethodSecurity(mode = ASPECTJ)) is on the classpath.

On the other hand , the actual fix lives in spring-security-core, where the code that scans for security annotations is located. The patch changes a comparison from

if (method == candidate) { … }

to

if (method.equals(candidate)) { … }

Using equals() lets the scanner recognise the same method loaded by different class-loaders/AspectJ weaves, so the annotations are no longer skipped and the bypass is closed.

So to conclude, both packages should be flagged, also the fixing commit is in the core package which is anoth proof that this package is vulnerable. Moreover, to my understanding, if you use spring-security-core 6.4.5 and lower, even with the updated spring-security-aspects 6.4.6 you will still be vulnerable.