CVE-2024-38810

What it actually does

Missing authorization check in @AuthorizeReturnObject processing allows security annotations to be bypassed, exposing return values without enforcing intended access controls.

Why it matters to the business

Attackers may obtain sensitive data that should have been protected by authorization rules, increasing risk of information disclosure across applications using the affected Spring Security versions.

How an attack unfolds

An unauthenticated attacker sends a request to an endpoint protected by @AuthorizeReturnObject; due to the authorization bypass in 6.3.0 and 6.3.1, the annotation is rendered ineffective and the protected object is returned in the response.

How to fix it

Upgrade Spring Security to a version containing commit 8fb44fe67980ef33dddb9ba3799d86edaf060fb8 or later; avoid versions 6.3.0 and 6.3.1.

How to confirm the fix worked

Confirm the Spring Security jar version is newer than 6.3.1 and contains the referenced commit; review application code for continued use of @AuthorizeReturnObject and test authorization behavior on affected endpoints.

Typical attack path

1. Identify application endpoints that use @AuthorizeReturnObject for post-authorization checks
2. Craft and send a network request to the target endpoint without required credentials or roles
3. Receive the unauthorized object or data in the response due to bypassed checks

How to detect it

Review application logs for requests to protected endpoints that return objects without evidence of prior authorization success; correlate with absence of expected role or permission checks in access logs.

What your security team should do

• Immediately upgrade all Spring Security 6.3.0/6.3.1 deployments to the fixed version
• Audit applications for use of @AuthorizeReturnObject and verify authorization logic post-upgrade
• Monitor for any unexpected data exposure in logs until remediation is complete