Overview
Spring Security is a comprehensive Java security framework for securing enterprise-level applications. It provides a powerful, flexible programming model that simplifies the development of secure applications by allowing you to manage authentication, authorization, and other security concerns with ease. Spring Security integrates seamlessly with the Spring Framework, offering robust tools for configuring access controls, managing user roles, and protecting resources, all while allowing Java to be your primary language for application development.
Authentication Bypass vulnerability (CVE-2012-5055) found in VMware SpringSource’s DaoAuthenticationProvider component. The issue arises because the component does not properly check the password when the user is not found during the authentication process. This flaw allows an attacker to submit arbitrary usernames without triggering the usual password validation checks.
Per StrongDM: An Authentication Bypass Vulnerability is a flaw in the user authentication mechanism that allows an attacker to bypass or circumvent the authentication process. By exploiting this weakness, the attacker gains unauthorized access to an application, service, or device. Once an intrusion is successfully executed, the attacker can steal sensitive information, install malicious software, or carry out malicious actions.
This issue affects multiple versions
Details
Module Info
- Product: Spring Security
- Affected packages: spring-security
- Affected versions: <2.0.9, >=3.0.0, <3.0.9, >=3.1.0, <3.1.4
- GitHub repository: https://github.com/spring-projects/spring-security/issues/2280
- Package manager: Maven
- Fixed in: 3.1.4, 3.0.9, 2.0.9
Vulnerability Info
The DaoAuthenticationProvider is an AuthenticationProvider implementation that uses a UserDetailsService and PasswordEncoder to authenticate a username and password. The vulnerability arises from the fact that the DaoAuthenticationProvider did not handle specific edge cases properly during authentication. This flaw could be exploited by an attacker to bypass authentication and gain unauthorized access to an application.
Credit
- The issue was discovered by Nicholas Goodwin.
Mitigation
Users of the affected components should apply one of the following mitigations:
- All users may upgrade to Spring Security 3.1.3+, 3.0.8+, or 2.0.8+
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
