Spring Security Path Matching Vulnerability in HttpSecurity Component

A vulnerability exists in Spring Security versions 7.0.0 through 7.0.4, specifically when applications use the 'securityMatchers(String)' method along with a 'PathPatternRequestMatcher.Builder' bean to add a servlet path. In such cases, requests may not be matched correctly, causing the associated security components to be bypassed. This can deactivate authentication, authorization, and other security measures on requests that should be protected.

Impact

Exploitation of this vulnerability can lead to the unintended deactivation of authentication, authorization, and other security controls on affected requests.

Remediation

Users can upgrade to Spring Security version 7.0.5 to address this vulnerability. If an upgrade is not possible, the servlet path can be directly included in the matcher pattern.