Overview
Spring Security is a complete framework that provides authentication, authorization, and other security features for Java applications, particularly those built with the Spring Framework.
An Authentication Bypass vulnerability (CVE-2024-22234) has been identified in Spring Security's spring-security-web module, which allows attackers to bypass authentication mechanisms by taking advantage of improper handling of null authentication parameters.
Per OWASP: "Authentication bypass occurs when an attacker is able to gain access to a system without having valid credentials, often due to flaws in the authentication mechanism."
This issue affects versions 6.1.0 to 6.1.6 and 6.2.0 to 6.2.1 of Spring Security's spring-security-web module.
Details
Module Info
- Product: Spring Security
- Affected packages: spring-security-core
- Affected versions: <6.1.7, >=6.2.0 <6.2.2
- GitHub repository: https://github.com/spring-projects/spring-security
- Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-web
- Package manager: Maven
- Fixed in: Spring Security 6.1.7 and 6.2.2
Vulnerability Info
CVE-2024-22234 is a high-severity vulnerability found in Spring Security's spring-security-web module versions 6.1.0 to 6.1.6 and 6.2.0 to 6.2.1. The issue arises when the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method is called with a null authentication parameter, leading to an incorrect true return value. This flaw allows attackers to bypass authentication checks, potentially granting unauthorized access to sensitive resources.
Credits
- This vulnerability was reported by Rogério Sorroche.
Mitigation
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Security.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
