Description

Spring Security versions 5.3.x prior to 5.3.2,  5.2.x prior to 5.2.4,  5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.

Affected Spring Products and Versions

• Spring Security
  • 5.3.x prior to 5.3.2
  • 5.2.x prior to 5.2.4
  • 5.1.x prior to 5.1.10
  • 5.0.x prior to 5.0.16
  • 4.2.x prior to 4.2.16

Mitigation

All users should discontinue the use of Encryptors#queryableText(CharSequence, CharSequence) and rely on their data store for querying encrypted data. Users should perform the following upgrades, as this method has been deprecated in newer versions of Spring Security. Older versions should upgrade to a supported branch. Releases that have fixed this issue include:

• Spring Security
  • 5.3.2
  • 5.2.4
  • 5.1.10
  • 5.0.16
  • 4.2.16

Credit

This issue was identified and responsibly reported by Neil Madden, ForgeRock.

References

• https://cwe.mitre.org/data/definitions/329.html

History

• 2020-05-07: Initial vulnerability report published.