Improper Authorization in LogNet grpc-spring-boot-starter

Executive Summary

This vulnerability is a vertical privilege escalation in the grpc-spring-boot-starter library (versions up to 5.2.0). It occurs due to improper handling of Spring Security's @Secured annotations. When a gRPC service method has both class-level and method-level @Secured annotations, the library incorrectly merges these rules using an OR operation instead of enforcing the stricter method-level rule. This allows low-privilege users to bypass intended authorization and gain unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect your gRPC service classes for instances where both class-level and method-level @Secured annotations are used simultaneously. Check if the method-level @Secured annotation is intended to enforce stricter access but is bypassed due to the library's incorrect merging of security rules.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers with low privileges to bypass security controls and perform unauthorized actions. For example, a user with ROLE_USER could access methods restricted to ROLE_ADMIN if both annotations are present. The impact depends on the sensitive operations protected by the misconfigured methods.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the grpc-spring-boot-starter library to a version that fixes this issue. If an update is unavailable, refactor affected services to avoid using both class-level and method-level @Secured annotations together. Alternatively, implement custom security logic to enforce stricter authorization rules.

Useful 0 Not Useful 0