| 제목 | LogNet grpc-spring-boot-starter <=5.2.0 Improper Authorization |
|---|
| 설명 | ## 1. Summary
`grpc-spring-boot-starter` processes Spring Security `@Secured` annotations on gRPC services/methods (its
default authorization mechanism). When a method is covered by **both** a class-level `@Secured` and a
method-level `@Secured`, the starter **appends both into one attribute set** and evaluates it with
`AffirmativeBased` (grant if **any** attribute matches). Adding a broad class-level rule therefore **silently
weakens** a stricter method-level rule:
- method-level `@Secured("ROLE_ADMIN")` **alone** → a `ROLE_USER` caller is correctly **DENIED**;
- the **same** method rule **plus** class-level `@Secured("ROLE_USER")` → the same `ROLE_USER` caller is
**GRANTED** (`ADMIN` collapses to `USER OR ADMIN`).
This is a vertical privilege escalation. The merge is silent (no docs, no startup warning) and fails **open**.
Severity is conditional: exploitation requires a service that stacks a broad class-level `@Secured` with a
stricter method-level `@Secured` — a configuration reachable using only the library's documented annotations.
The report does not claim this is a common or recommended pattern; only that, when present, the library
resolves it insecurely. Concrete C/I impact depends on the bypassed method; the library-level defect is the
silent loss of the stricter guard.
|
|---|
| 원천 | ⚠️ https://github.com/LogNet/grpc-spring-boot-starter/issues/423 |
|---|
| 사용자 | Wayde.Shi24 (UID 98472) |
|---|
| 제출 | 2026. 07. 16. AM 03:53 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 30. AM 08:19 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397089 [LogNet grpc-spring-boot-starter 까지 5.2.0 Annotation Processing 권한 상승] |
|---|
| 포인트들 | 20 |
|---|