提交 #892515: LogNet grpc-spring-boot-starter <=5.2.0 Improper Authorization

## 1. Summary

`grpc-spring-boot-starter` processes Spring Security `@Secured` annotations on gRPC services/methods (its
default authorization mechanism). When a method is covered by **both** a class-level `@Secured` and a
method-level `@Secured`, the starter **appends both into one attribute set** and evaluates it with
`AffirmativeBased` (grant if **any** attribute matches). Adding a broad class-level rule therefore **silently
weakens** a stricter method-level rule:
- method-level `@Secured("ROLE_ADMIN")` **alone** → a `ROLE_USER` caller is correctly **DENIED**;
- the **same** method rule **plus** class-level `@Secured("ROLE_USER")` → the same `ROLE_USER` caller is
**GRANTED** (`ADMIN` collapses to `USER OR ADMIN`).
This is a vertical privilege escalation. The merge is silent (no docs, no startup warning) and fails **open**.
Severity is conditional: exploitation requires a service that stacks a broad class-level `@Secured` with a
stricter method-level `@Secured` — a configuration reachable using only the library's documented annotations.
The report does not claim this is a common or recommended pattern; only that, when present, the library
resolves it insecurely. Concrete C/I impact depends on the bypassed method; the library-level defect is the
silent loss of the stricter guard.

• 来源: ⚠️ https://github.com/LogNet/grpc-spring-boot-starter/issues/423
• 用户: Wayde.Shi24 (UID 98472)
• 提交: 2026-07-16 03時53分 (2 月前)
• 管理: 2026-08-30 08時19分 (2 months later)
• 状态: 已接受
• VulDB条目: 397089 [LogNet grpc-spring-boot-starter 直到 5.2.0 Annotation Processing 权限提升]
• 积分: 20