CVE-2021-22112

Overview

Spring Security is a comprehensive Java security framework for securing enterprise-level applications. It provides a powerful, flexible programming model that simplifies the development of secure applications by allowing you to manage authentication, authorization, and other security concerns with ease. Spring Security integrates seamlessly with the Spring Framework, offering robust tools for configuring access controls, managing user roles, and protecting resources, all while allowing Java to be your primary language for application development.

‍

A vulnerability (CVE-2021-22112) has been identified in Spring Security, which may cause it to fail to save the SecurityContext to the HttpSession if it’s updated multiple times in a single request. Though it cannot be triggered by an attacker, it can unintentionally extend elevated privileges across an application if improperly managed, potentially exposing sensitive areas to unauthorized access.

‍

This issue affects multiple versions of Spring Security.

‍

Details

Module Info

• Product: Spring Security
• Affected packages: spring-security-web
• Affected versions: <5.2.9.RELEASE, >=5.3.0 <5.3.9.RELEASE, >=5.4.0 <5.4.4
• GitHub repository: https://github.com/spring-projects/spring-security
• Package manager: Maven

‍

Vulnerability Info

This Low-severity vulnerability, CVE-2021-22112, in Spring Security affects versions 5.4.0 to 5.4.3, 5.3.0 to 5.3.8.RELEASE, 5.2.0 to 5.2.8.RELEASE, and older unsupported versions.

‍

The issue arises when a developer updates the SecurityContext multiple times within a single HTTP request. Specifically, if the SecurityContext is modified before the HttpResponse is committed, then committed, and subsequently changed again before the SecurityContextPersistenceFilter completes, the framework may fail to save the final SecurityContext to the HttpSession.

‍

While this bug cannot be exploited directly by an attacker, it can create security loopholes if an application relies on temporary privilege elevation. If elevated privileges are intended only for a small part of the application, this vulnerability could unintentionally extend those privileges, potentially exposing parts of the application to unauthorized access or actions.

‍

Steps To Reproduce

This commit contains a test demonstrating the issue. This test fails on unpatched versions.

‍

Prerequisites

Set up a Spring application using an affected Spring Security version (e.g., 5.4.0 to 5.4.3 or 5.3.x to 5.3.8).

Ensure the application has a basic security configuration, including SecurityContextPersistenceFilter to manage session security.

‍

Reproduction Steps

1. Create a Controller Method: Set up a method in a controller to handle a request, where you change the SecurityContext multiple times in sequence.
2. Change SecurityContext before response is committed:
   1. In the controller method, update the SecurityContext with elevated privileges before the HttpResponse is committed.
   2. This might involve setting a new Authentication with elevated roles.
3. Commit the HttpResponse:
   1. Explicitly or implicitly commit the HttpResponse (e.g., by sending part of the response back to the client or using a ResponseEntity).
4. Change SecurityContext again:
   1. After committing the response, attempt to change the SecurityContext once more within the same request, this time with reduced privileges.
5. Observe the SecurityContext:
   1. After the SecurityContextPersistenceFilter completes, check the saved SecurityContext in the session.
   2. The SecurityContext may still hold elevated privileges from the initial change, as the last modification may not be persisted.

‍

Expected Result

If the vulnerability is present, the session’s SecurityContext will retain elevated privileges from the first modification rather than the final state, potentially exposing unintended parts of the application with higher access.

‍

Credits

• Daniel Beck
• Jeff Thompson
• Jesse Glick
• Wadeck Follonier
• CloudBees, Inc.

‍

Mitigation

Spring Security 4 and 5 are no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of Spring Security.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.