CVE-2014-0097: Improper Authentication in Spring Security
Summary
CVE-2014-0097: Improper Authentication in Spring Security. Affects org.springframework.security:spring-security-core across 2 version ranges.
>= 3.1.0, < 3.1.5.RELEASE
>= 3.2.0, < 3.2.2.RELEASE
Fixed in 3.1.5.RELEASE or 3.2.2.RELEASE, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Security package, specifically the org.springframework.security:spring-security-core module, is a widely used library in Java applications for implementing security features such as authentication and authorization. It provides a comprehensive set of APIs and utilities to secure web applications and services. However, versions 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 of Spring Security Core contain a vulnerability that allows improper authentication when using the ActiveDirectoryLdapAuthenticator. This vulnerability arises due to the failure of the authenticator to check the length of the password. If the directory allows anonymous binds, an attacker can exploit this flaw by supplying an empty password and gain unauthorized access.
Vulnerability Detail
The vulnerability (CVE-2014-0097) in Spring Security Core allows an attacker to bypass authentication and gain unauthorized access to protected resources. By exploiting the flaw in the ActiveDirectoryLdapAuthenticator, an attacker can supply an empty password and still be authenticated if the directory allows anonymous binds. This can lead to unauthorized access to sensitive information, privilege escalation, and potential compromise of the entire system. The vulnerability has a CVSS score of 7.3, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1.0, < 3.1.5.RELEASE3.1.5.RELEASE -
>= 3.2.0, < 3.2.2.RELEASE3.2.2.RELEASE
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to disable anonymous binds in the directory configuration. By disallowing anonymous binds, the vulnerability can be mitigated. However, this workaround may have implications on the functionality of the application, especially if anonymous binds are required for certain use cases. It is recommended to consult with the application's security team or administrators before implementing this workaround.
Conclusion
The vulnerability in Spring Security Core (CVE-2014-0097) allows improper authentication and unauthorized access to protected resources. It is crucial to upgrade to the fixed versions of Spring Security Core or implement the recommended workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
The vulnerability allows an attacker to bypass authentication and gain unauthorized access to protected resources. This can lead to unauthorized access to sensitive information, privilege escalation, and potential compromise of the entire system.
Versions 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 of Spring Security Core are affected by this vulnerability.
To fix this vulnerability, upgrade to the fixed versions of Spring Security Core: 3.2.2.RELEASE for versions 3.2.0 to 3.2.1, and 3.1.5.RELEASE for versions 3.1.0 to 3.1.5.
A possible workaround is to disable anonymous binds in the directory configuration. However, this may impact the functionality of the application and should be carefully considered.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.