Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Detecting Authorization Flaws in Java Spring via Source Code Review (SCR)

netspi.com | blog | #appsec | #access-control | #java | #privilege-escalation | #owasp | #authorization | #secure-code-review | #spring

Summary

Broken access control often slips past dynamic testing. This article shows how secure code review of Spring annotations, expressions, and filters surfaces Java Spring privilege escalation paths early.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Getting Started with API Security Best Practices
API security remains underprioritized as usage surges; the 2023 OWASP API Security Top 10 still leads with BOLA and broken authentication, and manual testing is needed where scanners fall short.
blog · netspi.com
Application Self Protection – A New Addition to the OWASP Top 10
Breaks down OWASP Top 10 2017 candidate A7, Insufficient Attack Protection, urging apps to detect, block, log, and respond to automated attacks rather than only validating input.
blog · netspi.com
An Introduction to the Open Software Assurance Maturity Model (OpenSAMM)
OpenSAMM, OWASP's free maturity framework, splits app security into four business functions—Governance, Construction, Verification, Deployment—letting organizations score each app in under an hour.
blog · netspi.com
Performing Code Reviews to PCI Requirements
We were asked by a customer about performing code review based on the PCI requirements.
blog · borghq.io
AI Application Security Testing: The Authorisation Boundary
Borg explains how to test whether AI retrieval features enforce tenant boundaries, turning OWASP LLM Top 10 2026 guidance into concrete authorisation tests inside the index query.
blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
back