Description

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan.

Affected Spring Products and Versions

• Spring Cloud SSO Connector version 2.1.2

Mitigation

Users of affected versions should apply the following mitigation:

• Releases that have fixed this issue include:
  • Spring Cloud SSO Connector: 2.1.3
• Alternatively, you can perform one of the following workarounds:
  • Bind your resource server to the SSO service plan via a service instance binding
  • Set “sso.connector.cloud.available=true” within your Spring application properties

Credit

This vulnerability was responsibly reported by the Pivotal SSO Service team.

History

2018-04-30: Initial vulnerability report published