CVE-2021-22113: Incorrect Authorization in Spring Cloud Netflix Zuul

Background

Spring Cloud Netflix Zuul is a popular library that provides dynamic routing, monitoring, and security capabilities to microservices applications. It acts as an API gateway, allowing requests to be routed to the appropriate microservice. The 'Sensitive Headers' functionality in Spring Cloud Netflix Zuul allows developers to specify a list of headers that should not be forwarded to downstream services. However, versions 2.2.6.RELEASE and below are vulnerable to an incorrect authorization issue that can bypass the 'Sensitive Headers' restriction. This vulnerability can be exploited by sending specially crafted URLs, potentially exposing sensitive information to unauthorized users. It is important to note that applications using Spring Security's StrictHttpFirewall are not affected by this vulnerability, as they reject requests that allow bypassing.

Vulnerability Detail

The vulnerability in Spring Cloud Netflix Zuul arises from a failure to properly enforce the 'Sensitive Headers' restriction when processing requests with specially constructed URLs. This can lead to the disclosure of sensitive information to unauthorized users. The impact of this vulnerability depends on the specific headers that are considered sensitive in the application. If an attacker can bypass the 'Sensitive Headers' restriction, they may be able to access sensitive data or perform unauthorized actions. The vulnerability has been assigned a severity rating of MODERATE.

Workaround

If upgrading to the fixed version is not immediately feasible, a workaround can be implemented by manually validating and rejecting requests that attempt to bypass the 'Sensitive Headers' restriction. This can be done by inspecting the requested URL and headers, and ensuring that the 'Sensitive Headers' restriction is properly enforced. Here is an example of how this can be done in Java using Spring Boot:

import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class ZuulController {

    @RequestMapping("/**")
    public String handleRequest() {
        // Check if the request allows bypassing the 'Sensitive Headers' restriction
        // Reject the request if bypassing is detected
        // Otherwise, process the request as usual
        // ...
    }
}

Conclusion

The vulnerability in Spring Cloud Netflix Zuul can allow unauthorized access to sensitive information by bypassing the 'Sensitive Headers' restriction. It is important to upgrade to the fixed version or implement the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.springframework.cloud:spring-cloud-netflix-zuul →

FAQ