Overview
Spring Security is a comprehensive Java security framework for securing enterprise-level applications. It provides a powerful, flexible programming model that simplifies the development of secure applications by allowing you to manage authentication, authorization, and other security concerns with ease. Spring Security integrates seamlessly with the Spring Framework, offering robust tools for configuring access controls, managing user roles, and protecting resources, all while allowing Java to be your primary language for application development.
Improper Session Handling or Improper Session Management vulnerability (CVE-2023-20865) has been found in Spring Security-based applications. It deals with an issue where the SecurityContext is not properly cleared or saved upon logout.
Per OWASP: Improper Session Handling occurs when mobile applications fail to securely manage session tokens, potentially allowing attackers to impersonate users by exploiting session data. Common issues include not invalidating sessions properly on the backend, insufficient timeout protections, or failing to reset session cookies when user roles change. These weaknesses can lead to unauthorized access, fraud, or data theft, making session management a critical part of security mobile applications.
This issue affects multiple versions.
Details
Module Info
- Product: Sprint Security
- Affected packages: spring-security
- Affected versions: >=5.7.0 <5.7.8, >=5.8.0 <5.8.3, >=6.0.0 <6.0.3
- GitHub repository: https://github.com/spring-projects/spring-security
- Package manager: Maven
- Fixed in: NES for Spring v5.7.15, v5.8.17
Vulnerability Info
The Improper Session Handling vulnerability specifically impacts the handling of the SecurityContext during the logout process in Spring Security, leading to potential issues such as unauthorized access or session leakage if the SecurityContext is not properly cleared.
Credit
- This issue was identified and reported by Daniel Furtlehner from Porsche Informatik.
Mitigation
Users of the affected versions should apply one of the following mitigations:
- 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3. No other steps are necessary.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
