CVE-2011-2732: CRLF Injection Vulnerability in Spring Security
Summary
CVE-2011-2732: Improper Control of Generation of Code in Spring Security. Affects org.springframework.security:spring-security-core across 2 version ranges.
< 2.0.7
>= 3.0.0, < 3.0.6
Fixed in 2.0.7 or 3.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is org.springframework.security:spring-security-core. It is a part of the Maven ecosystem and is used for implementing security features in Spring applications. Spring Security provides authentication and authorization functionalities, protecting applications from unauthorized access. However, a vulnerability has been identified in versions before 2.0.7 and 3.0.x before 3.0.6, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
Vulnerability Detail
The CRLF injection vulnerability in the logout functionality of Spring Security allows attackers to manipulate HTTP headers and perform HTTP response splitting attacks. By injecting malicious data into the spring-security-redirect parameter, an attacker can control the generation of code and insert arbitrary headers into the response. This can lead to various security issues, such as session hijacking, cross-site scripting (XSS), and cache poisoning.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.72.0.7 -
>= 3.0.0, < 3.0.63.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by upgrading to the fixed versions of Spring Security.
Conclusion
In conclusion, the CRLF injection vulnerability in Spring Security can lead to serious security issues. It is important to upgrade to the fixed versions of Spring Security to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
This vulnerability allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. It can lead to session hijacking, cross-site scripting (XSS), and cache poisoning.
Versions before 2.0.7 and 3.0.x before 3.0.6 are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Yes, patches are available in the form of fixed versions of Spring Security. It is recommended to upgrade to version 2.0.7 or later for versions before 2.0.7, and version 3.0.6 or later for versions 3.0.x before 3.0.6.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to the advisory]
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
