Description

In Spring Security versions 5.4.10, 5.5.6, and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers.

Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Affected Spring Products and Versions

• Spring Security
  • 5.4.x prior to 5.4.11
  • 5.5.x prior to 5.5.7
  • 5.6.x prior to 5.6.4
  • Earlier unsupported versions

Mitigation

Users should update to a version that includes fixes. 5.5.x users should upgrade to 5.5.7 or greater. 5.6.x users should upgrade to 5.6.4 or greater. Releases that have fixed this issue include:

• Spring Security
  • 5.4.11+
  • 5.5.7+
  • 5.6.4+
  • 5.7+

Credit

This vulnerability was discovered and responsibly reported by Hiroki Nishino, Toshiki Sasazaki, Yoshinori Hayashi, and Jonghwan Kim from LINE Corporation.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N&version=3.1

History

• 2022-05-16: Initial vulnerability report published.