| Package | Affected versions | Patched versions |
|---|---|---|
| com.linecorp.armeria:armeria | < 1.24.3 | 1.24.3 |
| armeria | < 1.24.3 | 1.24.3 |
Spring supports Matrix variables.
When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path
that may contain matrix variables.
In this situation, the Armeria decorators might not invoked because of the matrix variables.
Let's see the following example:
// Spring controller
@GetMapping("/important/resources")
public String important() {...}
// Armeria decorator
ServerBuilder sb = ...
sb.decoratorUnder("/important/", authService);
If an attacker sends a request with /important;a=b/resources, the request would bypass the authrorizer
Users can add decorators using regex. e.g. "regex:^/important.*"
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free