CVE-2024-13200: Springboot-blog Auth Bypass Vulnerability

CVE-2024-13200 Overview

CVE-2024-13200 is an improper access control vulnerability in wander-chu SpringBoot-Blog 1.0. The flaw resides in the preHandle function of src/main/java/com/my/blog/website/interceptor/BaseInterceptor.java, part of the HTTP POST Request Handler. Manipulation of HTTP POST requests bypasses access control checks enforced by the interceptor. The issue is remotely exploitable without authentication or user interaction. Public disclosure has occurred through VulDB and GitHub. The vendor was contacted but did not respond. The weakness maps to [CWE-266] Incorrect Privilege Assignment.

Critical Impact

Remote unauthenticated attackers can bypass interceptor-based access controls and reach protected POST endpoints in SpringBoot-Blog 1.0.

Affected Products

• wander-chu SpringBoot-Blog 1.0
• Component: BaseInterceptor.java HTTP POST Request Handler
• Function: preHandle

Discovery Timeline

• 2025-01-09 - CVE-2024-13200 published to NVD
• 2025-08-22 - Last updated in NVD database

Technical Details for CVE-2024-13200

Vulnerability Analysis

The SpringBoot-Blog application uses a Spring HandlerInterceptor named BaseInterceptor to enforce access control on incoming HTTP requests. The preHandle method is intended to validate session state and authorization before passing control to protected controller endpoints. Logic in preHandle fails to apply consistent access control to HTTP POST requests. Attackers can submit POST requests that the interceptor permits to proceed without the authorization checks applied to other request types.

The vulnerability falls under [CWE-266] Incorrect Privilege Assignment. The CVSS 4.0 vector indicates network-reachable exploitation with low complexity and no required privileges or user interaction. Confidentiality, integrity, and availability are each rated as low impact at the vulnerable system boundary. The EPSS probability is 0.082%, placing exploitation likelihood in the 24th percentile.

Root Cause

The preHandle implementation in BaseInterceptor.java does not uniformly validate authenticated session context for POST requests reaching protected routes. Logic branches in the interceptor allow specific request shapes or paths to skip authentication validation, granting access to functions that should require a valid session.

Attack Vector

A remote attacker crafts an HTTP POST request targeting an administrative or protected endpoint in the SpringBoot-Blog application. Because the preHandle interceptor does not reject the request, the controller executes the requested action under an unauthenticated or low-privilege context. Refer to the GitHub Issue Discussion and VulDB #290793 for additional technical context.

Detection Methods for CVE-2024-13200

Indicators of Compromise

• Unauthenticated HTTP POST requests to administrative paths under /admin/ or backend management routes returning 200 OK responses.
• Application logs showing controller execution without a corresponding authenticated session identifier.
• Unexpected creation, modification, or deletion of blog content, users, or configuration entries originating from external IP addresses.

Detection Strategies

• Inspect web server and application access logs for POST requests to protected endpoints that lack a valid session cookie or authentication header.
• Compare request volume on POST endpoints against authenticated user baselines to surface anomalous unauthenticated activity.
• Deploy WAF rules that require an authenticated session token for any POST request to administrative URI patterns.

Monitoring Recommendations

• Forward Spring Boot application logs and reverse proxy logs to a centralized analytics platform for correlation.
• Alert on HTTP 2xx responses to administrative POST endpoints when the request lacks expected authentication cookies.
• Monitor for outbound changes to blog content, user tables, or comment moderation queues outside expected administrator activity windows.

How to Mitigate CVE-2024-13200

Immediate Actions Required

• Restrict network exposure of SpringBoot-Blog 1.0 instances to trusted networks or place them behind authenticated reverse proxies.
• Audit BaseInterceptor.preHandle and ensure POST requests to non-public routes are subjected to the same session validation as GET requests.
• Review application and access logs for prior unauthenticated POST activity that may indicate exploitation.

Patch Information

No official vendor patch is available. The vendor was contacted prior to public disclosure but did not respond, according to the VulDB advisory. Organizations operating SpringBoot-Blog 1.0 should consider applying a forked code fix that enforces authentication for all non-public HTTP methods in BaseInterceptor.java or migrating to a maintained blogging platform.

Workarounds

• Place the application behind an authenticating reverse proxy that enforces session validation for all POST requests to protected paths.
• Modify BaseInterceptor.preHandle to explicitly check the authenticated principal regardless of HTTP method before returning true.
• Disable or remove administrative endpoints that are not required in the deployment.

# Example nginx location block enforcing auth on admin POSTs
location ~ ^/admin/ {
    limit_except GET {
        auth_request /auth/validate;
    }
    proxy_pass http://springboot_blog_upstream;
}