• 1 CVE-2023-34034 背景
  • 1.1 涉及既 library 版本
  • 1.2 漏洞涉及既安全問題
• 2 建立測試項目
  • 2.1 Maven dependencies
  • 2.2 HTTP APIs
  • 2.3 寫 Java code
    • 2.3.1 Controller
    • 2.3.2 Spring Security config class
• 3 測試結果
  • 3.1 使用有漏洞既版本
    • 3.1.1 測試結果：Permit 特定 endpoints、authenticate wildcard
    • 3.1.2 測試結果：Authenticate 特定 endpoints、permit wildcard
  • 3.2 使用已修復既版本
    • 3.2.1 測試結果：Permit 特定 endpoints、authenticate wildcard
    • 3.2.2 測試結果：Authenticate 特定 endpoints、permit wildcard
• 4 參考資料

• 5.6.0 至 5.6.11
• 5.7.0 至 5.7.9
• 5.8.0 至 5.8.4
• 6.0.0 至 6.0.4
• 6.1.0 至 6.1.1

• 5.6.12 或以上
• 5.7.10 或以上
• 5.8.5 或以上
• 6.0.5 或以上
• 6.1.2 或以上

• Maven parent POM：spring-boot-starter-parent
• Dependencies
  • spring-boot-starter-webflux
  • spring-boot-starter-security

1@RestController
2public class BusinessController {
3
4    @GetMapping("public")
5    public String _public() {
6        return "This is a public endpoint. You should see this without logging in.";
7    }
8
9    @GetMapping("secure")
10    public String secure() {
11        return "This is a secure endpoint. You should NOT see this without logging in.";
12    }
13}

1@Configuration
2public class SecurityConfiguration {
3
4    @Bean
5    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) throws Exception {
6        return http
7            .authorizeExchange().pathMatchers("/public").permitAll()
8            .and()
9            .authorizeExchange().pathMatchers("/**").authenticated()
10            .and()
11            .httpBasic()
12            .and()
13            .build();
14    }
15}

1@Configuration
2public class SecurityConfiguration {
3
4    @Bean
5    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) throws Exception {
6        return http
7            .authorizeExchange()
8                .pathMatchers("/public").permitAll()
9                .pathMatchers("/**").authenticated()
10            .and()
11            .httpBasic()
12            .and()
13            .build();
14    }
15}

1@Configuration
2public class SecurityConfiguration {
3
4    @Bean
5    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) throws Exception {
6        return http
7            .authorizeExchange(request -> request
8                .pathMatchers("/public").permitAll()
9                .pathMatchers("/**").authenticated())
10            .httpBasic()
11            .and()
12            .build();
13    }
14}

• spring-boot-starter-security 2.7.1
  • Spring Security 5.7.2

1. pathMatchers(<some paths>).permitAll()
2. pathMatchers(<wildcard>).authenticated()

1. pathMatchers(<some paths>).authenticated()
2. pathMatchers(<wildcard>).permitAll()

1. pathMatchers(<some paths>).permitAll()
2. pathMatchers(<wildcard>).authenticated()

1. pathMatchers(<some paths>).authenticated()
2. pathMatchers(<wildcard>).permitAll()

• Spring 官方文檔 - CVE-2023-34034: WebFlux Security Bypass With Un-Prefixed Double Wildcard Pattern
• Spring 官方文檔 - Dependency versions