Overview
Spring Security is a powerful framework that provides authentication, authorization, and other security-related features for Java applications. It integrates with the Spring Framework, letting developers implement complete security measures.
An authorization bypass vulnerability (CVE-2022-31692) has been found in spring-security-web, which allows attackers to evade authorization rules via FORWARD or INCLUDE dispatcher types. This vulnerability arises when specific configurations are in place, potentially enabling unauthorized access to protected resources.
Per OWASP: "Authorization bypass attacks allow an attacker to access resources or perform actions that they are not authorized to perform, by exploiting flaws in the application's authorization mechanisms."
This issue affects multiple versions of spring-security-web, specifically versions 5.6.0 through 5.6.8 and 5.7.0 through 5.7.4, from Spring Security.
Details
Module Info
- Product: Spring Security
- Affected packages: spring-security-core
- Affected versions: >=5.6.0 <5.6.9, >=5.7.0 <5.7.5
- GitHub repository: https://github.com/spring-projects/spring-security
- Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-core
- Package manager: Maven
- Fixed in: NES for Spring Security 5.7.14 5.8.16
Vulnerability Info
CVE-2022-31692 is a critical-severity vulnerability found in Spring Security versions 5.6.0 to 5.6.8 and 5.7.0 to 5.7.4. The vulnerability occurs when an application is configured to apply security to forward and include dispatcher types using the AuthorizationFilter, either manually or via the authorizeHttpRequests() method. If the application forwards or includes requests to higher-privilege-secured endpoints without proper authorization checks, an attacker could exploit this flaw to bypass security restrictions and gain unauthorized access.
Credits
- This vulnerability was reported by VMware Tanzu.
Mitigation
Spring Security 5 is no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Security.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
