Spring Security Authentication Bypass - Vulnerability Database

Spring Security Authentication Bypass

Description

A path matching inconsistency exists between Spring Security and Spring Framework that can lead to authentication bypass. Spring Security uses URL pattern matching to determine which resources require authentication, while Spring Framework uses similar patterns to route requests to controllers. Due to differences in how these components handle path matching—particularly regarding whitespace trimming and pattern strictness—certain URLs may be mapped to protected controllers by Spring Framework but not recognized as protected by Spring Security. This mismatch creates a security gap where authenticated endpoints become accessible without proper authorization.

Remediation

Apply the following remediation steps based on your Spring version:

Recommended Solution (Upgrade):

Upgrade to Spring Security 4.1.1 or later AND Spring Framework 4.3.1 or later
Configure Spring Security to use MvcRequestMatcher instead of AntPathRequestMatcher for URL authorization. This delegates pattern matching to Spring Framework, ensuring consistency:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .mvcMatchers("/admin/**").hasRole("ADMIN")
            .mvcMatchers("/api/**").authenticated();
    }
}

Alternative Solutions:

For Spring Framework 4.3.0+: Upgrading to 4.3.0 or later automatically sets trimTokens to false in AntPathMatcher, reducing inconsistencies
For Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x: Manually configure AntPathMatcher to disable token trimming using MVC Java config or XML namespace configuration:

@Configuration
@EnableWebMvc
public class WebMvcConfig implements WebMvcConfigurer {
    @Override
    public void configurePathMatch(PathMatchConfigurer configurer) {
        AntPathMatcher matcher = new AntPathMatcher();
        matcher.setTrimTokens(false);
        configurer.setPathMatcher(matcher);
    }
}

Defense in Depth:

Implement method-level security using @Secured, @PreAuthorize, or @RolesAllowed annotations on controller methods as an additional layer of protection
Conduct thorough testing of all protected endpoints with various URL formats including trailing slashes, encoded characters, and whitespace variations

Affected Versions: