• 1 CVE-2023-20860 背景
  • 1.1 涉及既 library 版本
  • 1.2 漏洞涉及既安全問題
• 2 建立測試項目
  • 2.1 Maven dependencies
  • 2.2 HTTP APIs
  • 2.3 寫 Java code
    • 2.3.1 Controller
    • 2.3.2 Spring Security config class
• 3 測試結果
  • 3.1 使用有漏洞既版本
    • 3.1.1 測試結果：Permit 特定 endpoints、authenticate wildcard
    • 3.1.2 測試結果：Authenticate 特定 endpoints、permit wildcard
  • 3.2 使用已修復既版本
    • 3.2.1 測試結果：Permit 特定 endpoints、authenticate wildcard
    • 3.2.2 測試結果：Authenticate 特定 endpoints、permit wildcard
• 4 參考資料

• 5.3.0 至 5.3.25
• 6.0.0 至 6.0.6

• 5.3.26 或以上
• 6.0.7 或以上

• Maven parent POM：spring-boot-starter-parent
• Dependencies
  • spring-boot-starter-web
  • spring-boot-starter-security

1@RestController
2public class BusinessController {
3
4    @GetMapping("public")
5    public String _public() {
6        return "This is a public endpoint. You should see this without logging in.";
7    }
8
9    @GetMapping("secure")
10    public String secure() {
11        return "This is a secure endpoint. You should NOT see this without logging in.";
12    }
13}

1@Configuration
2public class SecurityConfiguration {
3
4    @Bean
5    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
6        return http
7            .authorizeHttpRequests().mvcMatchers("/public").permitAll()
8            .and()
9            .authorizeHttpRequests().mvcMatchers("/**").authenticated()
10            .and()
11            .httpBasic()
12            .and()
13            .build();
14    }
15}

1@Configuration
2public class SecurityConfiguration {
3
4    @Bean
5    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
6        return http
7            .authorizeHttpRequests()
8                .mvcMatchers("/public").permitAll()
9                .mvcMatchers("/**").authenticated()
10            .and()
11            .httpBasic()
12            .and()
13            .build();
14    }
15}

1@Configuration
2public class SecurityConfiguration {
3
4    @Bean
5    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
6        return http
7            .authorizeHttpRequests(authorize -> authorize
8                .mvcMatchers("/public").permitAll()
9                .mvcMatchers("/**").authenticated())
10            .httpBasic()
11            .and()
12            .build();
13    }
14}

• spring-boot-starter-security 2.7.1
  • Spring Security 5.7.2
• spring-webmvc 5.3.21

1. mvcMatchers(<some paths>).permitAll()
2. mvcMatchers(<wildcard>).authenticated()

1. mvcMatchers(<some paths>).authenticated()
2. mvcMatchers(<wildcard>).permitAll()

• spring-boot-starter-security 2.7.1
  • Spring Security (multiple libraries) 5.7.2
• spring-webmvc 5.3.26

1. mvcMatchers(<some paths>).permitAll()
2. mvcMatchers(<wildcard>).authenticated()

1. mvcMatchers(<some paths>).authenticated()
2. mvcMatchers(<wildcard>).permitAll()

• Spring 官方文檔 - CVE-2023-20860: Security Bypass With Un-Prefixed Double Wildcard Pattern
• GitHub - limo520/CVE-2023-20860
  • Cve202320860Application.java
  • Cve202320860ApplicationTests.java