CVE-2025-3305: Ikun Library Authentication Bypass Vulnerability

CVE-2025-3305 Overview

CVE-2025-3305 is an improper access control vulnerability in 1902756969/code-projects IKUN_Library 1.0. The flaw resides in the addInterceptors function of MvcConfig.java within the Borrow Handler component. Manipulation of the interceptor configuration allows a remote authenticated attacker to bypass access restrictions and reach protected library management functions. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attempts against exposed deployments. This weakness is tracked under [CWE-266: Incorrect Privilege Assignment].

Critical Impact
Remote attackers with low privileges can bypass interceptor-based access controls and interact with borrow-related functionality that should be restricted to authorized roles.

Affected Products

1902756969 code-projects IKUN_Library 1.0
MvcConfig.java (Spring MVC interceptor configuration)
Borrow Handler component

Discovery Timeline

2025-04-05 - CVE-2025-3305 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-3305

Vulnerability Analysis

The vulnerability originates in the Spring MVC configuration class MvcConfig.java. The addInterceptors method defines which URL paths are protected by authentication and authorization interceptors. In IKUN_Library 1.0, the interceptor registration does not enforce access controls across all sensitive Borrow Handler endpoints. Requests to those endpoints reach controllers without a proper privilege check.

An attacker can send crafted HTTP requests over the network to interact with borrow functionality intended for higher-privileged users. Because the flaw sits in framework-level access control wiring, it affects any deployment of IKUN_Library 1.0 that exposes the web interface. Public disclosure of the technique in the referenced GitHub vulnerability documentation lowers the barrier to exploitation.

Root Cause

The root cause is Improper Access Control [CWE-266]. The addInterceptors registration in MvcConfig.java fails to cover the full set of Borrow Handler routes or applies overly permissive path patterns. As a result, authorization logic never executes for the exposed endpoints, and the application relies implicitly on client-side or UI-level restrictions.

Attack Vector

The attack vector is network-based and requires low privileges but no user interaction. An attacker authenticated as a low-privileged user, or in some configurations an unauthenticated user, issues direct HTTP requests to Borrow Handler URLs. The absence of an enforced interceptor for those paths allows the request to invoke controller logic. The technical details are documented in the VulDB entry 303502 and the associated VulDB CTI reference.

No verified proof-of-concept code is included here. Refer to the linked advisories for exploitation specifics.

Detection Methods for CVE-2025-3305

Indicators of Compromise

Unexpected HTTP requests to Borrow Handler endpoints originating from accounts without librarian or administrator roles.
Access log entries showing direct URL access to borrow-related routes without prior navigation through authenticated UI flows.
Repeated requests probing borrow, return, or record-management endpoints from a single source IP.

Detection Strategies

Review Spring MVC access logs for requests to Borrow Handler paths that bypass the login or role-check interceptor chain.
Correlate authenticated session identifiers with the privilege level required for each requested endpoint.
Deploy application-layer rules that flag HTTP methods and paths inconsistent with the requesting user's role.

Monitoring Recommendations

Enable verbose logging for MvcConfig interceptor execution to confirm which requests are intercepted.
Forward web application logs to a centralized SIEM or data lake for behavioral analysis of access patterns.
Alert on anomalous spikes in requests to borrow, return, or user-management endpoints outside business hours.

How to Mitigate CVE-2025-3305

Immediate Actions Required

Restrict network exposure of the IKUN_Library application to trusted internal networks or VPN users until a fix is applied.
Audit MvcConfig.java to confirm that all Borrow Handler routes are covered by the authentication and authorization interceptors.
Disable or remove the affected Borrow Handler endpoints if they are not required for production use.

Patch Information

No official vendor patch is listed in the NVD entry or in the referenced advisories at the time of publication. The project is hosted by 1902756969 on code-projects and does not have a formal security advisory. Monitor the GitHub vulnerability documentation and VulDB submission 550186 for updates. Organizations running IKUN_Library 1.0 should apply a source-level fix to MvcConfig.java that adds the missing interceptor mappings.

Workarounds

Update addInterceptors in MvcConfig.java to register the authentication interceptor against all Borrow Handler URL patterns, including wildcard paths.
Add server-side role checks inside each Borrow Handler controller method as defense in depth, rather than relying solely on interceptors.
Place the application behind a reverse proxy or web application firewall that enforces role-based path restrictions for borrow endpoints.

bash

# Configuration example: harden interceptor registration in MvcConfig.java
# Ensure all Borrow Handler paths are covered by the auth interceptor
#
# @Override
# public void addInterceptors(InterceptorRegistry registry) {
#     registry.addInterceptor(new AuthInterceptor())
#             .addPathPatterns("/borrow/**", "/return/**", "/admin/**")
#             .excludePathPatterns("/login", "/static/**");
# }