CVE-2024-38810: Spring Security Auth Bypass Vulnerability

CVE-2024-38810 Overview

CVE-2024-38810 is a missing authorization vulnerability in Spring Security 6.3.0 and 6.3.1. The flaw affects applications that use the @AuthorizeReturnObject annotation to enforce method-level authorization on returned objects. When this annotation is applied, the framework fails to evaluate associated security annotations, rendering them ineffective. Attackers reach protected data over the network without authentication or user interaction. The Common Weakness Enumeration classifies this issue under [CWE-287] Improper Authentication and [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated network attackers can bypass method-level security annotations and access confidential return objects in affected Spring Security applications.

Affected Products

VMware Spring Security 6.3.0
VMware Spring Security 6.3.1
Applications using the @AuthorizeReturnObject annotation

Discovery Timeline

2024-08-20 - CVE-2024-38810 published to NVD
2025-02-28 - Last updated in NVD database

Technical Details for CVE-2024-38810

Vulnerability Analysis

The vulnerability resides in how Spring Security 6.3.0 and 6.3.1 process the @AuthorizeReturnObject annotation. This annotation instructs the framework to apply method security to objects returned from a method call. When developers combine @AuthorizeReturnObject with other security annotations such as @PreAuthorize, @PostAuthorize, or @Secured, the framework skips evaluation of those annotations on the returned object. Authorization checks that developers intended to enforce silently become no-ops. Attackers exploit the gap to retrieve sensitive data through normal application endpoints. The vulnerability requires no authentication, no user interaction, and no special access conditions over the network.

Root Cause

The defect lies in the proxy and interceptor logic that processes @AuthorizeReturnObject. Spring Security applies the return-object wrapper but fails to chain the additional security annotations through the authorization manager. The result is a Missing Authorization condition [CWE-862] where intended access control is never enforced. See the Spring Security Advisory CVE-2024-38810 for vendor confirmation of the root cause.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a normal HTTP request to an endpoint whose controller or service method returns an object annotated for authorization enforcement. Because the security annotations are not evaluated on the returned object, the response includes data that should have been filtered or rejected. The vulnerability impacts confidentiality without affecting integrity or availability.

No verified public proof-of-concept code is available. Refer to the vendor advisory for technical details on affected configurations.

Detection Methods for CVE-2024-38810

Indicators of Compromise

Unexpected HTTP 200 responses returning sensitive fields from endpoints that should require elevated authorization
Application logs showing successful method invocations on @AuthorizeReturnObject-annotated methods from unauthenticated sessions
Access patterns where low-privilege or anonymous principals retrieve objects scoped to higher-privilege roles

Detection Strategies

Inventory all Spring Boot applications and identify dependencies on spring-security-core versions 6.3.0 or 6.3.1
Perform static code analysis to locate usage of @AuthorizeReturnObject combined with @PreAuthorize, @PostAuthorize, or @Secured
Execute authenticated and unauthenticated test requests against endpoints that return annotated objects and compare responses for unauthorized field disclosure

Monitoring Recommendations

Forward Spring Security audit events and access logs to a centralized analytics platform for correlation
Alert on anomalous read volumes against APIs exposing user, financial, or PII objects
Track dependency versions in software composition analysis tooling to detect drift back to vulnerable Spring Security releases

How to Mitigate CVE-2024-38810

Immediate Actions Required

Upgrade Spring Security to version 6.3.2 or later as directed in the Spring Security Advisory CVE-2024-38810
Audit all controllers and services using @AuthorizeReturnObject and validate that authorization is enforced after patching
Restrict network exposure of affected APIs until the patch is deployed

Patch Information

VMware released fixed Spring Security artifacts addressing CVE-2024-38810. Users on 6.3.x should upgrade to 6.3.2 or later. Consult the Spring Security Advisory CVE-2024-38810 for the authoritative list of patched versions and release notes.

Workarounds

Remove @AuthorizeReturnObject from affected methods and enforce authorization through @PreAuthorize or @PostAuthorize on the method itself until upgrade is possible
Implement compensating controls at the API gateway or service mesh to enforce role-based access to sensitive endpoints
Add manual authorization checks inside service methods that return protected objects

bash

# Configuration example: pin Spring Security to a patched version in Maven
mvn versions:use-dep-version -Dincludes=org.springframework.security:spring-security-core -DdepVersion=6.3.2 -DforceVersion=true