CVE-2017-4971: Insecure Default Initialization of Resource in Pivotal Spring Web Flow
Summary
CVE-2017-4971: Insecure Default Initialization of Resource in Pivotal Spring Web Flow. Affects org.springframework.webflow:spring-webflow versions >= 2.4.0, < 2.4.5. Fixed in 2.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pivotal Spring Web Flow is a framework that provides support for building web applications with controlled navigation. It allows developers to define flows that guide users through a series of steps or screens. The MvcViewFactoryCreator is a component in Spring Web Flow that is responsible for creating view factories. By default, the useSpringBinding property of MvcViewFactoryCreator is disabled, which means that applications may be vulnerable to malicious EL expressions in view states that process form submissions without explicit data binding property mappings.
Vulnerability Detail
The vulnerability in Pivotal Spring Web Flow through version 2.4.4 allows for the execution of malicious EL expressions in view states that process form submissions. This can lead to various security issues, such as remote code execution or information disclosure. The vulnerability arises when the useSpringBinding property is not changed from its default value of 'false'. Attackers can exploit this by submitting specially crafted form data that includes malicious EL expressions, which will be evaluated by the application and potentially executed.
How To Fix
Minimum fixed version
2.4.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a workaround is to explicitly set the useSpringBinding property of MvcViewFactoryCreator to 'true' in the application configuration. This can be done by adding the following code snippet to the application's configuration file:
<bean id="mvcViewFactoryCreator" class="org.springframework.webflow.mvc.builder.MvcViewFactoryCreator">
<property name="useSpringBinding" value="true" />
</bean>
Conclusion
In summary, the vulnerability in Pivotal Spring Web Flow allows for the execution of malicious EL expressions in view states that process form submissions. To fix this vulnerability, it is important to update to the latest version of Pivotal Spring Web Flow or apply the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.webflow:spring-webflow →
FAQ
Pivotal Spring Web Flow is a framework for building web applications with controlled navigation. It allows developers to define flows that guide users through a series of steps or screens.
The MvcViewFactoryCreator is a component in Pivotal Spring Web Flow that is responsible for creating view factories. It is used to generate views for different states in a flow.
The useSpringBinding property in MvcViewFactoryCreator determines whether Spring binding should be used for form submissions in view states. When set to 'true', it enables Spring binding, while setting it to 'false' disables it.
This vulnerability can lead to various security issues, such as remote code execution or information disclosure. Attackers can exploit the vulnerability by submitting specially crafted form data that includes malicious EL expressions, which will be evaluated and potentially executed by the application.
To mitigate this vulnerability, it is recommended to update to Pivotal Spring Web Flow version 2.4.5 or later. Alternatively, you can set the useSpringBinding property of MvcViewFactoryCreator to 'true' in the application configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.webflow:spring-webflow.
