Privilege Escalation in SpringBlade via Unauthorized Feign Endpoint

Executive Summary

SpringBlade versions 2.7.3 through 3.5.0 have a privilege escalation flaw. Authenticated attackers can create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint. This endpoint is exposed via @RestController without proper authorization checks.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized administrator account creation by monitoring POST requests to internal Feign endpoints. Inspect logs for unusual JWT token generation using the hardcoded signing key. Verify if low-privilege users can access @RestController endpoints without role validation.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to escalate privileges from a low-privilege user to administrator. This enables cross-tenant data pollution and allows persistent backdoor access. The vulnerability is exploited by forging tokens using a hardcoded JWT signing key found in publicly available JARs.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SpringBlade to a version beyond 3.5.0. Remove the hardcoded JWT signing key from JARs. Implement strict role-based access control for all internal endpoints. Disable unprotected Feign user-creation endpoints and validate JWT tokens for caller identity and roles.

Useful 0 Not Useful 0