CVE-2018-11040: Vulnerability in org.springframework:spring-core
Summary
CVE-2018-11040: Moderate severity vulnerability that affects org.springframework:spring-core. Affects org.springframework:spring-core across 2 version ranges.
>= 4.3.0.RELEASE, < 4.3.18.RELEASE
>= 5.0.0.RELEASE, < 5.0.7.RELEASE
Fixed in 4.3.18.RELEASE or 5.0.7.RELEASE, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2018-11040 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.springframework:spring-core is a widely used package in the Maven ecosystem. It provides core functionality for the Spring Framework, a popular Java application framework. This package is responsible for handling various aspects of Spring applications, including dependency injection, resource management, and transaction management. However, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, as well as older unsupported versions, are vulnerable to a moderate severity issue.
Vulnerability Detail
The vulnerability in org.springframework:spring-core allows web applications to enable cross-domain requests via JSONP (JSON with Padding). This can be exploited through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Although these features are not enabled by default in Spring Framework or Spring Boot, if MappingJackson2JsonView is configured in an application, JSONP support is automatically available. This enables cross-domain requests, potentially leading to security issues.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0.RELEASE, < 4.3.18.RELEASE4.3.18.RELEASE -
>= 5.0.0.RELEASE, < 5.0.7.RELEASE5.0.7.RELEASE
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a workaround is to disable or remove the configuration for MappingJackson2JsonView in the application. This will prevent the automatic availability of JSONP support and mitigate the vulnerability. Here is an example of how to disable MappingJackson2JsonView in a Spring Boot application:
@Configuration
public class WebConfig extends WebMvcConfigurerAdapter {
@Override
public void configureViewResolvers(ViewResolverRegistry registry) {
registry.enableContentNegotiation(new MappingJackson2JsonView());
}
}
Conclusion
In conclusion, org.springframework:spring-core versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, as well as older unsupported versions, are vulnerable to a moderate severity issue that enables cross-domain requests via JSONP. It is crucial to upgrade to the fixed versions and review application configurations to ensure JSONP support is not inadvertently enabled. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-core →
FAQ
The vulnerability allows cross-domain requests via JSONP, which can potentially lead to security issues such as unauthorized access to sensitive data or the execution of malicious code.
No, JSONP support is not enabled by default. However, if MappingJackson2JsonView is configured in an application, JSONP support is automatically available.
No, only versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, as well as older unsupported versions, are affected.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-f26x-pr96-vw86/GHSA-f26x-pr96-vw86.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-core.
