提交 #853121: Jeepay V3.2.0 Improper Access Controls

A method-level authorization bypass exists in the Jeepay Manager backend. The application uses Spring Security annotations such as @PreAuthorize on many controller methods to define fine-grained permission requirements. However, the Spring Security configuration only enables web security and does not enable method-level security. As a result, the permission expressions declared by @PreAuthorize are not enforced at runtime.

The issue can be observed in the Manager security configuration:

jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/secruity/WebSecurityConfig.java

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {
The HTTP security rule only requires the request to be authenticated:

.authorizeHttpRequests((auth) -> {
auth.anyRequest().authenticated();
});
There is no @EnableMethodSecurity annotation, and no legacy @EnableGlobalMethodSecurity annotation, in the Manager security configuration. Therefore, Spring Security only verifies whether the request has a valid authenticated principal. It does not enforce the method-level permission checks declared on controller methods.

For example, the system log list API declares the following permission requirement:

jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java

@PreAuthorize("hasAuthority('ENT_LOG_LIST')")
@RequestMapping(value="", method = RequestMethod.GET)
public ApiPageRes<SysLog> list() {
The corresponding route is:

GET /api/sysLog
According to the code, this endpoint should only be accessible to users who have the ENT_LOG_LIST authority. In practice, because method-level security is not enabled, the @PreAuthorize("hasAuthority('ENT_LOG_LIST')") expression is not evaluated. Any authenticated Manager user can reach the controller method as long as the request passes the web-layer rule anyRequest().authenticated().

This creates a privilege escalation condition. A low-privilege Manager user without ENT_LOG_LIST can still access the system log list endpoint and retrieve system log data. The same root cause may affect other Manager and Merchant endpoints that rely on @PreAuthorize for fine-grained access control.

Technical Root Cause
The authorization model is split into two layers:

Web-layer authentication, configured in SecurityFilterChain
Method-level authorization, expected through @PreAuthorize
Only the first layer is active. The configuration enables:

@EnableWebSecurity
and then permits all authenticated requests:

auth.anyRequest().authenticated();
This means Spring Security checks whether the user is logged in, but it does not check whether the user has the specific authority required by the controller method.

To make @PreAuthorize effective in Spring Security 6 / Spring Boot 3, method-level security must be explicitly enabled, for example:

@EnableMethodSecurity
Without this annotation, the fine-grained permission declarations remain present in source code but are not enforced.

Verified Impact
The issue was verified in a local Docker deployment. A low-privilege Manager user was created with only homepage-related permissions. The user did not have the ENT_LOG_LIST authority. After logging in and obtaining a valid token, the low-privilege user was able to request:

GET /api/sysLog
The server returned HTTP 200 and system log data instead of rejecting the request with HTTP 403 or an equivalent authorization error.

This confirms that the endpoint is protected only by authentication, not by the intended authority check.

Security Impact
An authenticated low-privilege user may access Manager APIs beyond the permissions assigned to the user's role. Depending on the affected endpoint, this may expose system logs, operator data, role data, order data, merchant data, payment configuration, or other administrative information.

The issue affects the integrity of the role-based access control model because permissions configured in the application are not reliably enforced by the backend.

Expected Behavior
A user without the required authority should not be able to access a controller method protected by @PreAuthorize.

For the system log list endpoint:

@PreAuthorize("hasAuthority('ENT_LOG_LIST')")
a user without ENT_LOG_LIST should receive HTTP 403 or an equivalent authorization failure.

Actual Behavior
A user without ENT_LOG_LIST can access GET /api/sysLog as long as the user is authenticated.

Remediation
Enable method-level security in the Manager and Merchant security configuration classes.

For Spring Security 6 / Spring Boot 3:

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class WebSecurityConfig {
}
The fix should be applied at least to:

jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/secruity/WebSecurityConfig.java
jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/secruity/WebSecurityConfig.java
Regression tests should verify:

anonymous users are rejected with HTTP 401;
authenticated users without the required authority are rejected with HTTP 403;
authenticated users with the required authority can access the endpoint successfully.

• 来源: ⚠️ https://gist.github.com/glockie029/768b792112dd05b6d0037a83a6d9d993
• 用户: s1ldyd (UID 98860)
• 提交: 2026-06-09 17時28分 (2 月前)
• 管理: 2026-08-03 11時35分 (2 months later)
• 状态: 已接受
• VulDB条目: 385554 [jeequan jeepay 直到 3.2.9 PreAuthorize SysLogController.java WebSecurityConfig 权限提升]
• 积分: 20