Overview and Vulnerability Info
Spring Security is widely used in Java applications to handle user login, role-based access, and other security-related tasks. By integrating into the Spring ecosystem, it makes it easier for developers to enforce best security practices, reduce vulnerabilities, and streamline user authentication across their apps.
A Authentication Bypass vulnerability (CVE-2019-11272) has been identified in spring-security-core from Spring Security, which allows attackers to authenticate with null if the user has a null encoded password.
Per Common Attack Pattern Enumeration and Classification CAPEC-115: Authentication Bypass is when an attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
This issue affects versions 4.2.0 through 4.2.12 of spring-security-core from Spring Security.
Details
Module Info
- Product: Spring Security
- Affected packages: spring-security-core
- Affected versions: <4.2.13
- GitHub repository: https://github.com/spring-projects/spring-security
- Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-core
- Package manager: Maven
- Fixed in: NES for Spring Security v4.2.22
Vulnerability Info
CVE-2019-11272 is a high-severity vulnerability found in Spring Security versions 4.2.0 to 4.2.12, and older unsupported releases. The issue appears when the PlaintextPasswordEncoder is in use and a user’s encoded password is encoded as null. In such cases, an attacker can gain unauthorized access by literally using “null” as the password. This oversight allows attackers to bypass normal authentication checks and potentially access sensitive data or functions within the application.
Credits
- Tim Büthe and Daniel Neagaru from mytaxi.
Mitigation
Spring Security 4 is no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Security.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
