CVE-2019-3802: Improper Neutralization of Wildcards or Matching Symbols in Spring Data JPA
Summary
CVE-2019-3802: Improper Neutralization of Wildcards or Matching Symbols. Affects org.springframework.data:spring-data-jpa across 3 version ranges.
< 1.11.22
>= 2.0.0, < 2.1.8
>= 2.1.0, < 2.1.8
Fixed in 1.11.22 or 2.1.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Data JPA is a library that provides a framework for easily implementing JPA-based repositories. It simplifies the process of interacting with databases by providing a set of abstractions and utilities. This vulnerability affects versions up to and including 2.1.6, 2.0.14, and 1.11.20 of Spring Data JPA. The vulnerability arises when using ExampleMatcher with certain StringMatchers, such as STARTING, ENDING, or CONTAINING. In such cases, a maliciously crafted example value can lead to more results being returned than expected.
Vulnerability Detail
The vulnerability arises due to improper neutralization of wildcards or matching symbols in the ExampleMatcher of Spring Data JPA. When a maliciously crafted example value is supplied, it can cause the ExampleMatcher to return more results than anticipated. This can potentially lead to security issues or incorrect data retrieval.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.221.11.22 -
>= 2.0.0, < 2.1.82.1.8 -
>= 2.1.0, < 2.1.82.1.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a possible workaround is to avoid using the affected StringMatchers (STARTING, ENDING, or CONTAINING) in ExampleMatcher. Instead, consider using other StringMatchers or custom implementations that do not exhibit the vulnerability. Here's an example of how to create a custom ExampleMatcher without using the affected StringMatchers:
ExampleMatcher customExampleMatcher = ExampleMatcher.matching()
.withMatcher("propertyName", ExampleMatcher.GenericPropertyMatchers.exact());
Conclusion
In conclusion, the vulnerability in Spring Data JPA (CVE-2019-3802) arises due to improper neutralization of wildcards or matching symbols in the ExampleMatcher. It can be mitigated by upgrading to version 2.1.8 or a later version of Spring Data JPA. Alternatively, avoiding the affected StringMatchers or creating custom implementations can also help mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.data:spring-data-jpa →
FAQ
Spring Data JPA is a library that provides a framework for easily implementing JPA-based repositories. It simplifies database interactions and provides abstractions and utilities for working with databases.
Versions up to and including 2.1.6, 2.0.14, and 1.11.20 of Spring Data JPA are affected by this vulnerability.
ExampleMatcher is a class in Spring Data JPA that allows specifying example criteria for querying entities. It provides various StringMatchers for matching string properties.
The vulnerability can lead to more results being returned than expected when a maliciously crafted example value is supplied. This can potentially result in security issues or incorrect data retrieval.
To mitigate this vulnerability, it is recommended to upgrade to version 2.1.8 or a later version of Spring Data JPA. Alternatively, you can avoid using the affected StringMatchers (STARTING, ENDING, or CONTAINING) in ExampleMatcher or create custom implementations that do not exhibit the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.data:spring-data-jpa.
