Architect's Tech Stack
Jun 2, 2021 · Backend Development
Spring Boot %2e Path Normalization Trick and Authentication Bypass in Versions ≤2.3.0.RELEASE
The article explains how Spring Boot versions up to 2.3.0.RELEASE normalize request paths—including decoding %2e and handling directory traversal—which can be exploited to bypass authentication, and shows the code differences that cause this behavior in newer releases.
Authentication BypassInterceptorPath Normalization
0 likes · 9 min read