CVE-2017-8039: Insecure Default Initialization of Resource in Pivotal Spring Web Flow
Summary
CVE-2017-8039: Insecure Default Initialization of Resource in Pivotal Spring Web Flow. Affects org.springframework.webflow:spring-webflow versions < 2.4.6. Fixed in 2.4.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pivotal Spring Web Flow is a framework that provides a module for building web applications with controlled navigation and state management. It allows developers to define flows that guide users through a series of steps or screens. The MvcViewFactoryCreator is a component in Spring Web Flow that is responsible for creating view factories for rendering views. By default, the useSpringBinding property of MvcViewFactoryCreator is disabled, which can lead to a vulnerability in applications that do not change this default value.
Vulnerability Detail
The vulnerability in Pivotal Spring Web Flow through version 2.4.5 arises from an incomplete fix for CVE-2017-4971. Applications that do not modify the useSpringBinding property are susceptible to malicious Expression Language (EL) expressions in view states that process form submissions without explicit data binding property mappings. This can allow an attacker to execute arbitrary code or perform unauthorized actions within the application context. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.9.
How To Fix
Minimum fixed version
2.4.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to manually set the useSpringBinding property to 'true' in the application configuration. This can be done by adding the following code snippet to the configuration file:
<bean id="mvcViewFactoryCreator" class="org.springframework.webflow.mvc.builder.MvcViewFactoryCreator">
<property name="useSpringBinding" value="true" />
</bean>
Conclusion
The vulnerability in Pivotal Spring Web Flow through version 2.4.5 can allow attackers to execute arbitrary code or perform unauthorized actions within the application context. It is crucial to upgrade to version 2.4.6 or later and configure the useSpringBinding property correctly to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.webflow:spring-webflow →
FAQ
Pivotal Spring Web Flow is a framework for building web applications with controlled navigation and state management. It provides a module that allows developers to define flows that guide users through a series of steps or screens.
The MvcViewFactoryCreator is a component in Pivotal Spring Web Flow that is responsible for creating view factories for rendering views. It is used to configure the behavior of view states in the flow.
The useSpringBinding property is a configuration option in the MvcViewFactoryCreator component. When set to 'true', it enables secure data binding for form submissions in view states. By default, this property is disabled ('false').
This vulnerability allows an attacker to inject malicious Expression Language (EL) expressions in view states that process form submissions. This can lead to arbitrary code execution or unauthorized actions within the application context.
To mitigate this vulnerability, it is recommended to upgrade to version 2.4.6 or later of the org.springframework.webflow:spring-webflow package. Additionally, ensure that the useSpringBinding property is explicitly set to 'true' in the application configuration.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.webflow:spring-webflow.
