Description

Spring Security versions 5.3.x prior to 5.3.2,  5.2.x prior to 5.2.4,  5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor…

Description

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.

Affected Spring Products and Versions

• Reactor Netty
  • 0.9.3
  • 0.9.4

Mitigation

Users of affected versions should upgrade to 0.9.5 (reactor-bom Dysprosium SR-5). No other steps are necessary.

• Reactor Netty
  • 0.9.5

Credit

This issue was…

Description

Reactor Netty HttpClient, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been…

Description

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker…

Description

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints.

Only non-authenticated endpoints are…

Description

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header in the response where the filename attribute is derived from user supplied input.

Specifically, an application is vulnerable when all of the following are true:

• The header is prepared with org.springframework.http.ContentDisposition.
• The filename is set via one of:
  • ContentDisposition.Builder#filename(String), or
  • ContentDisposition.Builder#filename(String, US_ASCII)
• The value for the filename is derived from user supplied input.
• The user supplied input is not sanitized by the application.
• The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details).

An application is not vulnerable if any of the following is true:

• The application does not set a “Content-Disposition” response header.
• The header is not prepared with org.springframework.http.ContentDisposition.
• The filename is set via one of:
  • ContentDisposition.Builder#filename(String, UTF_8), or
  • ContentDisposition.Builder#filename(String, ISO_8859_1)
• The filename is not derived from user supplied input.
• The filename is derived from user supplied input but sanitized by the application.

Affected Spring Products and Versions

• Spring Framework
  • 5.2.0 to 5.2.2
  • 5.1.0 to 5.1.12
  • 5.0.0 to 5.0.15

Mitigation

Users of affected versions should apply the following mitigation. 5.2.x users should upgrade to 5.2.3. 5.1.x users should upgrade to 5.1.13. 5.0.x users should upgrade to 5.0.16. No other steps are necessary.  Releases that have fixed this issue include:

• Spring Framework
  • 5.2.3
  • 5.1.13
  • 5.0.16

Credit

This issue was identified and responsibly reported by Roman Shalymov from EPAM.

References

• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/
• https://github.com/spring-projects/spring-framework/issues/24220
…

Description

Reactor Netty, versions 0.8.x prior to 0.8.13 and 0.9.x prior to 0.9.1, depends on vulnerable versions of netty (versions prior to 4.1.42), which incorrectly handles whitespace before a colon in headers, leading to HTTP request smuggling attacks.

…

Description

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11284
…

Description

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of “null”.

Affected Spring Products and Versions

• Spring Security 4.2 to 4.2.12
• Older unsupported versions are also affected
• Note that Spring Security 5+ is not impacted by this vulnerability.

Mitigation

Users of affected versions should apply the following mitigation:

• 4.2.x users should upgrade to 4.2.13
• Older versions should upgrade to a supported branch

There are no other mitigation steps necessary.

Credit

This issue was identified and responsibly reported by Tim Büthe and Daniel Neagaru from mytaxi.

History

2019-06-19: Initial vulnerability report published

Description

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.

This vulnerability exposes applications that meet all of the following requirements:

• Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer)
• Uses the DefaultRedirectResolver in the AuthorizationEndpoint

This vulnerability does not expose applications that:

• Act in the role of an Authorization Server and use a different RedirectResolver implementation other than DefaultRedirectResolver
• Act in the role of a Resource Server only (e.g. @EnableResourceServer)
• Act in the role of a Client only (e.g. @EnableOAuthClient)

Affected Spring Products and Versions

• Spring Security OAuth 2.3 to 2.3.5
• Spring Security OAuth 2.2 to 2.2.4
• Spring Security OAuth 2.1 to 2.1.4
• Spring Security OAUth 2.0 to 2.0.17

Mitigation

Users of affected versions should apply the following mitigation:

• <strong>2.3.x</strong> users should upgrade to <strong>2.3.6</strong>
• <strong>2.2.x</strong> users should upgrade to <strong>2.2.5</strong>
• <strong>2.1.x</strong> users should upgrade to <strong>2.1.5</strong>
• <strong>2.0.x</strong> users should upgrade to <strong>2.0.18</strong>
• Older versions should upgrade to a supported branch

There are no other mitigation steps necessary.

For users of Spring Boot 1.5.x and Spring IO Platform Cairo, it is highly recommended to override the spring-security-oauth version to the latest version containing the patch for the CVE. In order to override the version, you need to declare/set the property spring-security-oauth.version.

Below are instructions for users of Spring Boot 1.5.x.

To override a property using Maven, declare the property in your pom’s section:


2.0.18.RELEASE


To override a property using Gradle, configure the value in your build.gradle script:

ext['spring-security-oauth.version'] = '2.0.18.RELEASE'

Or in gradle.properties:

spring-security-oauth.version=2.0.18.RELEASE

NOTE: The same instructions apply for users of Spring IO Platform Cairo. However, the version to specify is 2.2.5.RELEASE.

Credit

This issue was identified and responsibly reported by Mike Noordermeer.

References

• Spring Security OAuth <a href="https://projects.spring.io/spring-security-oauth/docs/oauth2.html"&gt;documentation&lt;/a&gt;, see section <em>“Authorization Server Configuration”</em>
• Example configuration for <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/tests/annotation/approval/src/main/java/demo/Application.java#L36"&gt;&lt;code&gt;@EnableAuthorizationServer&lt;/code&gt;&lt;/a…