CVE-2020-5397: CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux
Summary
CVE-2020-5397: CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux. Affects org.springframework:spring-webmvc versions >= 5.2.0, < 5.2.3. Fixed in 5.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The vulnerable packages in this case are 'org.springframework:spring-webmvc' and 'org.springframework:spring-webflux'. These packages are commonly used for building web applications using the Spring MVC or Spring WebFlux modules. The vulnerability allows for CSRF attacks through CORS preflight requests targeting non-authenticated endpoints.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of CORS preflight requests in Spring MVC and Spring WebFlux. These requests are used to determine if a cross-origin request is safe to send. However, the vulnerability allows an attacker to perform CSRF attacks by exploiting the lack of authentication in preflight requests. While preflight requests should not include credentials, Chrome-based browsers violate this requirement when using client certificates for authentication. This allows an attacker to bypass authentication and potentially perform unauthorized actions. It's important to note that no HTTP body can be sent or received as a result of this attack.
How To Fix
Minimum fixed version
5.2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a possible workaround is to disable CORS support for non-authenticated endpoints. This can be achieved by configuring the application to reject CORS preflight requests or by implementing additional authentication mechanisms for these endpoints.
Conclusion
In conclusion, the CSRF attack via CORS preflight requests vulnerability in Spring MVC and Spring WebFlux can be mitigated by upgrading to version 5.2.3 or later. If immediate upgrading is not possible, disabling CORS support for non-authenticated endpoints or implementing additional authentication mechanisms can serve as temporary workarounds. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
The vulnerability allows for CSRF attacks through CORS preflight requests, potentially leading to unauthorized actions being performed by an attacker.
Versions 5.2.x prior to 5.2.3 of the Spring Framework are vulnerable to this CSRF attack via CORS preflight requests.
No, authenticated endpoints are not vulnerable to this specific attack. The vulnerability only affects non-authenticated endpoints.
Yes, a possible workaround is to disable CORS support for non-authenticated endpoints or implement additional authentication mechanisms for these endpoints.
Yes, the CVSS score for this vulnerability is 5.3.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
