CVE-2014-3527: Authorization Bypass in Spring Security
Summary
CVE-2014-3527: Authorization Bypass in Spring Security. Affects org.springframework.security:spring-security-core across 2 version ranges.
< 3.1.7
>= 3.2.0, < 3.2.5
Fixed in 3.1.7 or 3.2.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is org.springframework.security:spring-security-core. Spring Security is a powerful and highly customizable authentication and access control framework for Java applications. It provides comprehensive security services for web applications, including authentication, authorization, session management, and more. This vulnerability specifically affects the CAS Proxy ticket authentication feature of Spring Security.
Vulnerability Detail
The vulnerability in Spring Security's CAS Proxy ticket authentication allows a malicious CAS Service to deceive another CAS Service into authenticating a proxy ticket that is not associated. This occurs because the proxy ticket authentication relies on information from the HttpServletRequest, which is populated based on untrusted information within the HTTP request. As a result, access control restrictions on which CAS services can authenticate to one another can be bypassed. The impact of this vulnerability depends on whether CAS Proxy tickets are used and if access control decisions are based on the CAS Service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.73.1.7 -
>= 3.2.0, < 3.2.53.2.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the CVE-2014-3527 vulnerability in Spring Security's CAS Proxy ticket authentication allows for an authorization bypass. Users of affected versions should upgrade to the recommended versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
Spring Security is a powerful authentication and access control framework for Java applications, providing comprehensive security services for web applications.
CAS Proxy ticket authentication is a feature in Spring Security that allows one CAS Service to authenticate another CAS Service using proxy tickets.
The vulnerability allows a malicious CAS Service to trick another CAS Service into authenticating a proxy ticket that is not associated, bypassing any access control restrictions on CAS service authentication.
The impact depends on the usage of CAS Proxy tickets and whether access control decisions are based on the CAS Service. If not using CAS Proxy tickets or not basing access control decisions on the CAS Service, there is no impact.
This vulnerability was identified by David Ohsie and brought to the attention of the CAS Development team.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
