CVE-2018-1199: Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core, and org.springframework:spring-core
Summary
CVE-2018-1199: Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing secu... Affects org.springframework.security:spring-security-core across 3 version ranges.
>= 4.1.0, < 4.1.5
>= 4.2.0, < 4.2.4
>= 5.0.0, < 5.0.1
Fixed in 4.1.5, 4.2.4 or 5.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2018-1199 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package org.springframework.security:spring-security-core is a part of the Spring Security framework, which provides authentication and authorization functionalities for Java applications. The package org.springframework:spring-core is a part of the Spring Framework, which provides a comprehensive programming and configuration model for Java applications. These packages are widely used in the Java ecosystem for building secure and robust applications.
Vulnerability Detail
The vulnerability (CVE-2018-1199) arises from a lack of consideration for URL path parameters in the processing of security constraints in Spring Security and Spring Framework. By exploiting special encodings in URL path parameters, an attacker can potentially bypass security constraints. This issue stems from the ambiguity in the handling of path parameters in the Servlet Specification, where different Servlet containers handle path parameters differently. In this specific attack, the use of different character encodings in path parameters allows an attacker to bypass secured Spring MVC static resource URLs.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.1.0, < 4.1.54.1.5 -
>= 4.2.0, < 4.2.44.2.4 -
>= 5.0.0, < 5.0.15.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability (CVE-2018-1199) in org.springframework.security:spring-security-core and org.springframework:spring-core allows for the bypassing of security constraints, potentially leading to unauthorized access to protected resources. It is crucial to upgrade to the fixed versions of the affected packages to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
This vulnerability allows an attacker to bypass security constraints, potentially gaining unauthorized access to protected resources in a Spring Security or Spring Framework application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the recommended fixes to prevent any potential exploitation.
The recommended approach is to upgrade to the fixed versions of the affected packages. However, if upgrading is not immediately feasible, you can consider implementing additional security measures, such as web application firewalls, to mitigate the risk to some extent.
You can find more information about this vulnerability, including its technical details and the fixed versions of the affected packages, in the advisory on the GitHub Advisory Database: [link to the advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
