Description

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T19:17:03.673Z",
  "pubdate": "2026-08-26T19:17:03.673Z",
  "executiveSummary": "DWSurvey version 6.14.0 contains a critical authentication bypass vulnerability stemming from insecure API endpoint handling. This flaw allows unauthenticated remote attackers to circumvent standard access control mechanisms by interacting with specific, improperly protected API routes. The vulnerability resides within the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters, which fail to validate session tokens or user credentials before executing requested logic. Successful exploitation grants an unauthorized actor the ability to perform operations intended only for authenticated users, potentially leading to unauthorized data access, system manipulation, or complete administrative takeover. This vulnerability poses a significant risk to the integrity and confidentiality of the DWSurvey application. Given that the exploit can be initiated without prior authentication, the barrier to entry for an attacker is minimal, requiring only network access to the target instance. Organizations utilizing DWSurvey 6.14.0 are exposed to unauthorized information disclosure and potential service disruption if left unaddressed.",
  "technicalDetails": "The vulnerability in DWSurvey version 6.14.0 is identified as an Authentication Bypass, specifically targeting the application's API layer. The root cause lies in a failure of the security filter chain to correctly enforce authentication requirements for specific URI patterns. In many Java-based web frameworks, including those likely utilized by DWSurvey, path matching logic for security interceptors can be bypassed if the configuration does not account for wildcards or normalized paths correctly.\nSpecifically, the endpoints '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' appear to be incorrectly excluded from the global authentication filters. The use of the wildcard operator in '/api/dwsurvey/up/**' suggests that any request prefixing this path is permitted to proceed without a valid session, cookie, or authorization header. An attacker can leverage this by crafting HTTP requests targeting these endpoints to bypass the authentication gatekeeper entirely.\nThe attack flow proceeds as follows: First, the attacker identifies a DWSurvey instance running version 6.14.0. Second, the attacker sends a specially crafted GET or POST request to the identified API endpoints. Because the underlying controller or service associated with these routes assumes that incoming requests have already been vetted by the middleware, the application processes the request without requesting identity verification. Consequently, the application logic executes the sensitive functions associated with these API routes as an unauthenticated or 'anonymous' user, which may inherit administrative privileges depending on the default state of the session context.\nThe post-exploitation impact is severe. Since these endpoints are likely intended for administrative tasks or user-specific data retrieval, an attacker can access sensitive survey data, modify existing surveys, or potentially manipulate account configurations. There is no requirement for a high-privilege account to initiate this attack, as the flaw bypasses the authentication step altogether. The vulnerability is externally reachable, meaning any remote attacker with network connectivity to the web server can execute these requests. The lack of validation on the 'up' and 'none' routes indicates a critical misconfiguration in the Spring Security or similar architectural components handling the application's request pipeline."
}