CVE-2019-3778: Open Redirect vulnerability in spring-security-oauth and spring-security-oauth2
Summary
CVE-2019-3778: spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability. Affects org.springframework.security.oauth:spring-security-oauth across 4 version ranges.
< 2.0.17.RELEASE
>= 2.1.0.RELEASE, < 2.1.4.RELEASE
>= 2.2.0.RELEASE, < 2.2.4.RELEASE
>= 2.3.0.RELEASE, < 2.3.5.RELEASE
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spring-security-oauth and spring-security-oauth2 packages are used for implementing OAuth 2.0 authorization servers and clients in Spring applications. These packages provide functionality for handling authentication and authorization processes. However, versions prior to 2.3.5, 2.2.4, 2.1.4, and 2.0.17 are vulnerable to an open redirector attack that can leak an authorization code.
Vulnerability Detail
The vulnerability allows a malicious user or attacker to craft a request to the authorization endpoint using the authorization code grant type and specify a manipulated redirection URI. This can cause the authorization server to redirect the resource owner user-agent to a URI controlled by the attacker, leaking the authorization code. Applications acting as an Authorization Server and using the DefaultRedirectResolver in the AuthorizationEndpoint are affected.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.17.RELEASE2.0.17.RELEASE -
>= 2.1.0.RELEASE, < 2.1.4.RELEASE2.1.4.RELEASE -
>= 2.2.0.RELEASE, < 2.2.4.RELEASE2.2.4.RELEASE -
>= 2.3.0.RELEASE, < 2.3.5.RELEASE2.3.5.RELEASE
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of the packages.
Conclusion
The Open Redirect vulnerability in spring-security-oauth and spring-security-oauth2 can lead to the leakage of authorization codes, potentially allowing unauthorized access to protected resources. It is crucial to upgrade to the fixed versions of the packages (2.3.5, 2.2.4, 2.1.4, or 2.0.17) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework.security.oauth:spring-security-oauth →
FAQ
The vulnerability can lead to the leakage of authorization codes, potentially allowing an attacker to gain unauthorized access to protected resources.
Versions prior to 2.3.5, 2.2.4, 2.1.4, and 2.0.17 of the spring-security-oauth and spring-security-oauth2 packages are affected.
No, this vulnerability only affects applications acting as an Authorization Server and using the DefaultRedirectResolver in the AuthorizationEndpoint.
No, there is no known workaround. It is recommended to upgrade to the fixed versions of the packages.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-77rv-6vfw-x4gc/GHSA-77rv-6vfw-x4gc.json
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security.oauth:spring-security-oauth.
