Overview
Spring Security is a comprehensive Java security framework for securing enterprise-level applications. It provides a powerful, flexible programming model that simplifies the development of secure applications by allowing you to manage authentication, authorization, and other security concerns with ease. Spring Security integrates seamlessly with the Spring Framework, offering robust tools for configuring access controls, managing user roles, and protecting resources, all while allowing Java to be your primary language for application development.
An Authentication Bypass vulnerability (CVE-2014-0097) has been identified in Spring Security’s ActiveDirectoryLdapAuthenticator component. The vulnerability occurs because the component does not check the length of the password provided during authentication. If the LDAP directory allows anonymous binds, an attacker can authenticate with an empty password, potentially gaining unauthorized access. This flaw can compromise the security of the application and lead to further exploitation of sensitive data or services.
Per Common Attack Pattern Enumeration and Classification CAPEC-115: Authentication Bypass is when an attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
This issue affects versions from 3.1.0 to 3.1.5 and 3.2.0 to 3.2.1 of spring-security-ldap from Spring Security.
Details
Module Info
- Product: Spring Security
- Affected packages: spring-security-ldap
- Affected versions: >=3.1.0 <3.1.6, >=3.2.0 <3.2.2
- GitHub repository: https://github.com/spring-projects/spring-security
- Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-ldap
- Package manager: Maven
- Fixed in: NES for Spring Security 4.2.21
Vulnerability Info
The ActiveDirectoryLdapAuthenticator in Spring Security fails to properly check password length, allowing attackers to bypass authentication mechanisms if the LDAP server allows anonymous bind. Exploiting this vulnerability, attackers could gain unauthorized access to applications that rely on Spring Security for authentication.
Credits
- Issue identified by the Spring Development team.
Mitigation
Spring Security 4.2.x is no longer community-supported. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Security.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
