Spring Security 在 WebFlux 下的权限绕过分析<\/h1>

前言<\/h2>
Spring Security 是 Spring 生态系统中广泛使用的安全框架，用于处理认证和授权。在传统的 Servlet 栈中，Spring Security 通过过滤器链来实现安全控制。而在响应式编程模型 WebFlux 中，Spring Security 采用了不同的实现方式，这可能导致一些安全配置上的差异和潜在的权限绕过问题。<\/p>

环境搭建<\/h2>

要分析 WebFlux 下的权限绕过问题，首先需要搭建一个基于 Spring WebFlux 和 Spring Security 的测试环境：<\/p>

创建 Spring Boot 项目并添加依赖：<\/li> <\/ol>

<dependency><\/span>
<\/span><\/span>    <groupId><\/span>org.springframework.boot<\/groupId><\/span>
<\/span><\/span>    <artifactId><\/span>spring-boot-starter-webflux<\/artifactId><\/span>
<\/span><\/span><\/dependency><\/span>
<\/span><\/span><dependency><\/span>
<\/span><\/span>    <groupId><\/span>org.springframework.boot<\/groupId><\/span>
<\/span><\/span>    <artifactId><\/span>spring-boot-starter-security<\/artifactId><\/span>
<\/span><\/span><\/dependency><\/span>
<\/span><\/span><\/code><\/pre>
配置基本的安全规则：<\/li>
<\/ol>
@EnableWebFluxSecurity<\/span>
<\/span><\/span>public<\/span> class<\/span> SecurityConfig<\/span> {<\/span>
<\/span><\/span>    @Bean<\/span>
<\/span><\/span>    public<\/span> SecurityWebFilterChain securityWebFilterChain<\/span>(<\/span>ServerHttpSecurity http)<\/span> {<\/span>
<\/span><\/span>        return<\/span> http
<\/span><\/span>            .<\/span>authorizeExchange<\/span>()<\/span>
<\/span><\/span>                .<\/span>pathMatchers<\/span>(<\/span>"\/admin\/**"<\/span>).<\/span>hasRole<\/span>(<\/span>"ADMIN"<\/span>)<\/span>
<\/span><\/span>                .<\/span>pathMatchers<\/span>(<\/span>"\/user\/**"<\/span>).<\/span>hasRole<\/span>(<\/span>"USER"<\/span>)<\/span>
<\/span><\/span>                .<\/span>anyExchange<\/span>().<\/span>permitAll<\/span>()<\/span>
<\/span><\/span>            .<\/span>and<\/span>()<\/span>
<\/span><\/span>            .<\/span>httpBasic<\/span>()<\/span>
<\/span><\/span>            .<\/span>and<\/span>()<\/span>
<\/span><\/span>            .<\/span>build<\/span>();<\/span>
<\/span><\/span>    }<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>漏洞复现<\/h2>
在 WebFlux 环境下，路径匹配逻辑与传统的 Servlet 环境有所不同，可能导致权限绕过。以下是几种常见的绕过场景：<\/p>
场景1：路径规范化差异<\/h3>
.<\/span>pathMatchers<\/span>(<\/span>"\/admin\/**"<\/span>).<\/span>hasRole<\/span>(<\/span>"ADMIN"<\/span>)<\/span>
<\/span><\/span><\/code><\/pre>攻击者可能通过以下方式绕过：<\/p>

\/admin\/..\/public<\/code> - 在某些配置下可能被解析为 \/public<\/code><\/li>
\/admin\/\/subpath<\/code> - 多余的斜杠可能导致匹配失败<\/li>
<\/ul>
场景2：大小写敏感性问题<\/h3>
如果配置不当，路径匹配可能对大小写不敏感：<\/p>

\/ADMIN\/panel<\/code> 可能绕过 \/admin\/**<\/code> 的权限检查<\/li>
<\/ul>
场景3：后缀匹配问题<\/h3>
.<\/span>pathMatchers<\/span>(<\/span>"\/api\/user"<\/span>).<\/span>hasRole<\/span>(<\/span>"USER"<\/span>)<\/span>
<\/span><\/span><\/code><\/pre>攻击者可能通过添加后缀绕过：<\/p>

\/api\/user.json<\/code><\/li>
\/api\/user\/<\/code><\/li>
<\/ul>
漏洞分析<\/h2>
WebFlux 解析路径流程<\/h3>

请求接收<\/strong>：WebFlux 通过 HttpWebHandlerAdapter<\/code> 接收请求<\/li>
路径解析<\/strong>：使用 PathPatternParser<\/code> 解析请求路径<\/li>
路径匹配<\/strong>：与配置的 PathPattern<\/code> 进行匹配<\/li>
安全决策<\/strong>：根据匹配结果应用相应的安全规则<\/li>
<\/ol>
Security 的 pathMatchers 匹配流程<\/h3>

PathPatternParser<\/code> 将配置的路径模式转换为 PathPattern<\/code> 对象<\/li>
对于每个请求，PathPattern<\/code> 尝试与请求路径匹配<\/li>
匹配时考虑：

路径分隔符 (\/<\/code>)<\/li>
通配符 (*<\/code>, **<\/code>)<\/li>
路径变量 ({var}<\/code>)<\/li>
正则表达式<\/li>
<\/ul>
<\/li>
<\/ol>
绕过原理总结<\/h3>
权限绕过的根本原因在于路径解析和匹配过程中的不一致性：<\/p>

路径规范化差异<\/strong>：WebFlux 和底层服务器对路径规范化的处理可能不同<\/li>
匹配严格度不足<\/strong>：pathMatchers<\/code> 默认配置可能不够严格<\/li>
大小写敏感性<\/strong>：默认情况下可能不区分大小写<\/li>
后缀处理<\/strong>：对路径后缀的处理可能导致绕过<\/li>
<\/ol>
防御措施<\/h2>

使用严格的路径匹配<\/strong>：<\/li>
<\/ol>
.<\/span>pathMatchers<\/span>(<\/span>"\/admin\/**"<\/span>).<\/span>hasRole<\/span>(<\/span>"ADMIN"<\/span>)<\/span>
<\/span><\/span>\/\/ 添加明确的拒绝规则
<\/span><\/span><\/span><\/span>.<\/span>pathMatchers<\/span>(<\/span>"\/admin"<\/span>).<\/span>denyAll<\/span>()<\/span>
<\/span><\/span>.<\/span>pathMatchers<\/span>(<\/span>"\/admin\/*"<\/span>).<\/span>denyAll<\/span>()<\/span>
<\/span><\/span><\/code><\/pre>
规范化路径<\/strong>：<\/li>
<\/ol>
http.<\/span>pathMatchers<\/span>(<\/span>"\/admin\/**"<\/span>).<\/span>hasRole<\/span>(<\/span>"ADMIN"<\/span>)<\/span>
<\/span><\/span>    .<\/span>pathMatchers<\/span>(<\/span>"\/admin"<\/span>).<\/span>hasRole<\/span>(<\/span>"ADMIN"<\/span>)<\/span>
<\/span><\/span>    .<\/span>pathMatchers<\/span>(<\/span>"\/admin\/"<\/span>).<\/span>hasRole<\/span>(<\/span>"ADMIN"<\/span>);<\/span>
<\/span><\/span><\/code><\/pre>
使用正则表达式进行严格匹配<\/strong>：<\/li>
<\/ol>
.<\/span>pathMatchers<\/span>(<\/span>"\/admin\/{*path}"<\/span>).<\/span>hasRole<\/span>(<\/span>"ADMIN"<\/span>)<\/span>
<\/span><\/span><\/code><\/pre>
启用严格模式<\/strong>：<\/li>
<\/ol>
@Bean<\/span>
<\/span><\/span>public<\/span> PathPatternParser pathPatternParser<\/span>()<\/span> {<\/span>
<\/span><\/span>    PathPatternParser parser =<\/span> new<\/span> PathPatternParser();<\/span>
<\/span><\/span>    parser.<\/span>setMatchOptionalTrailingSeparator<\/span>(<\/span>false<\/span>);<\/span>
<\/span><\/span>    return<\/span> parser;<\/span>
<\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>
测试边缘情况<\/strong>：<\/li>
<\/ol>

测试各种路径变形：\/admin<\/code>, \/admin\/<\/code>, \/admin\/\/<\/code>, \/admin\/..\/<\/code>, \/ADMIN\/<\/code> 等<\/li>
测试带后缀的路径：\/admin.json<\/code>, \/admin\/panel.xml<\/code> 等<\/li>
<\/ul>
最佳实践<\/h2>

始终对安全路径配置进行完整测试<\/li>
使用最小权限原则，默认拒绝所有请求<\/li>
定期审查安全配置，特别是路径匹配规则<\/li>
考虑使用自定义的 PathPatternParser<\/code> 以确保一致的路径解析<\/li>
在可能的情况下，使用基于方法的安全注解作为补充<\/li>
<\/ol>
@PreAuthorize<\/span>(<\/span>"hasRole('ADMIN')"<\/span>)<\/span>
<\/span><\/span>@GetMapping<\/span>(<\/span>"\/admin\/manage"<\/span>)<\/span>
<\/span><\/span>public<\/span> Mono<<\/span>String><\/span> manage<\/span>()<\/span> {<\/span>
<\/span><\/span>    \/\/ ...
<\/span><\/span><\/span><\/span>}<\/span>
<\/span><\/span><\/code><\/pre>通过理解 WebFlux 环境下 Spring Security 的工作原理和潜在的权限绕过场景，开发人员可以更安全地配置应用程序，防止未授权访问。<\/p>

Spring Security 在 WebFlux 下的权限绕过分析<\/h1>

漏洞复现<\/h2> 在 WebFlux 环境下，路径匹配逻辑与传统的 Servlet 环境有所不同，可能导致权限绕过。以下是几种常见的绕过场景：<\/p>

漏洞分析<\/h2>

漏洞复现<\/h2>
在 WebFlux 环境下，路径匹配逻辑与传统的 Servlet 环境有所不同，可能导致权限绕过。以下是几种常见的绕过场景：<\/p>