Overview
Spring Security is a powerful framework for securing Java-based web applications. It provides authentication, authorization, and protection against common security vulnerabilities such as cross-site scripting (XSS), cross-site request forgery (CSRF), and session fixation attacks.
A cryptographic weakness vulnerability (CVE-2020-5408) has been identified in spring-security-crypto from Spring Security, which allows attackers to derive the unencrypted values using a dictionary attack.
A dictionary attack is a type of brute force attack that uses a precomputed list of potential values, such as words or phrases, to attempt to uncover unencrypted data.
This issue affects multiple versions of spring-security-crypto from Spring Security.
Details
Module Info
- Product: Spring Security
- Affected packages: spring-security-crypto
- Affected versions: <4.2.16, >=5.0.0 <5.0.16, >=5.1.0 <5.1.10, >=5.2.0 <5.2.4, >=5.3.0 <5.3.2
- GitHub repository: https://github.com/spring-projects/spring-security
- Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-crypto
- Package manager: Maven
- Fixed in: NES for Spring Security 4.2.21
Vulnerability Information
CVE-2020-5408 is a vulnerability in Spring Security versions from 4.2.0 through 5.3.1 that uses a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryption. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
The vulnerability is classified under CWE-329. Generation of predictable initialization vector (IV) with Cipher Block Chain (CBC) Mode. This causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key. Attackers can infer original plaintext values based on predictable ciphertext patterns.
Credits
- Issue identified and reported by Neil Madden, ForgeRock
Mitigation
Spring Security 4.2.x is no longer community-supported. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Security.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
