Spring Security Servlet Path Matching Vulnerability Leading to Authorization Bypass

A vulnerability exists in Spring Security versions 7.0.0 through 7.0.4, where the servlet path defined in XML authorization rules is not properly included in path matching. This issue arises when using the `<sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/>` configuration. As a result, the associated authorization rules are not applied, potentially allowing unauthorized access to protected resources.

Impact

Exploitation of this vulnerability can lead to unauthorized access by bypassing defined authorization rules, allowing users to access endpoints without proper authentication or authorization.

Remediation

Users can upgrade to Spring Security 7.0.5 to address this vulnerability. If an upgrade is not possible, the servlet path can be directly included in the URL pattern for the `intercept-url` element, using an appropriate `access` expression for the application.