CVE-2024-38820

Overview

Spring Framework is a comprehensive Java framework for building enterprise-level applications. It provides a powerful, flexible programming model that simplifies the development of web applications by allowing you to use Java as your primary language while offering a variety of tools to manage application configuration, data access, and security.

‍

An improper locale vulnerability (CVE-2024-38820) has been identified in Spring Framework, which could potentially result in fields not being protected as expected.

‍

This issue affects multiple versions of Spring Security.

‍

Details

Module Info

• Product: Spring Framework
• Affected packages: spring-context, spring-core, spring-web, spring-webflux, spring-webmvc, spring-websocket 
• Affected versions: <5.3.41, >=6.0.0 <6.0.25, >=6.1.0 <6.1.14
• GitHub repository: https://github.com/spring-projects/spring-framework
• Package manager: Maven
• Fixed in: NES for Spring Framework v5.3.42

‍

Vulnerability Info

The fix for CVE-2022-22968 addressed most risks of case insensitivity but still left a potential weakness in the disallowedFields method. Java’s toLowerCase method uses the JVM’s default locale, which may cause fields to not be protected as expected, depending on the field and the JVM’s default locale.

‍

Steps To Reproduce

The following test in DataBinderTests demonstrates the potential weakness. It shows a scenario where the JVM is running with a locale that causes a disallowed field to be set, resulting in the test failing. With the applied fix, the same test will pass.

@Test
void setDisallowedFields_CVE_2024_38820() throws BindException  {
	// switching the default locale causes this test to break before the fix
	Locale.setDefault(Locale.forLanguageTag("tr-TR"));
	TestBean rod = new TestBean();
	DataBinder binder = new DataBinder(rod);
	binder.setDisallowedFields("JEDI");

	MutablePropertyValues pvs = new MutablePropertyValues();
	pvs.add("name", "Rod");
	pvs.add("jedi", "true");

	binder.bind(pvs);
	binder.close();

	assertThat(rod.getName()).as("changed name correctly").isEqualTo("Rod");
	assertThat(binder.getBindingResult().getSuppressedFields()).containsExactlyInAnyOrder("jedi");

‍

Credits

• Marek Parfianowicz

‍

Mitigation

Spring Framework 5.3 is no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of Spring Framework.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.