| शीर्षक | LogNet grpc-spring-boot-starter <=5.2.0 Improper Authorization |
|---|
| विवरण | ## 1. Summary
`grpc-spring-boot-starter` processes Spring Security `@Secured` annotations on gRPC services/methods (its
default authorization mechanism). When a method is covered by **both** a class-level `@Secured` and a
method-level `@Secured`, the starter **appends both into one attribute set** and evaluates it with
`AffirmativeBased` (grant if **any** attribute matches). Adding a broad class-level rule therefore **silently
weakens** a stricter method-level rule:
- method-level `@Secured("ROLE_ADMIN")` **alone** → a `ROLE_USER` caller is correctly **DENIED**;
- the **same** method rule **plus** class-level `@Secured("ROLE_USER")` → the same `ROLE_USER` caller is
**GRANTED** (`ADMIN` collapses to `USER OR ADMIN`).
This is a vertical privilege escalation. The merge is silent (no docs, no startup warning) and fails **open**.
Severity is conditional: exploitation requires a service that stacks a broad class-level `@Secured` with a
stricter method-level `@Secured` — a configuration reachable using only the library's documented annotations.
The report does not claim this is a common or recommended pattern; only that, when present, the library
resolves it insecurely. Concrete C/I impact depends on the bypassed method; the library-level defect is the
silent loss of the stricter guard.
|
|---|
| स्रोत | ⚠️ https://github.com/LogNet/grpc-spring-boot-starter/issues/423 |
|---|
| उपयोगकर्ता | Wayde.Shi24 (UID 98472) |
|---|
| सबमिशन | 16/07/2026 03:53 AM (2 महीनों पहले) |
|---|
| संयम | 30/08/2026 08:19 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397089 [LogNet grpc-spring-boot-starter तक 5.2.0 Annotation Processing अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|