CVE-2023-20860: Security Bypass in Spring Framework
Summary
CVE-2023-20860: Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch. Affects org.springframework:spring across 2 version ranges.
>= 5.3.0, < 5.3.26
>= 6.0.0, < 6.0.7
Fixed in 5.3.26 or 6.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2023-20860 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The framework includes various modules, such as Spring Security, which offers authentication and authorization features. However, versions 6.0.0 - 6.0.6 and 5.3.0 - 5.3.25 of the Spring Framework are vulnerable to a security bypass issue when using the mvcRequestMatcher pattern with the "**" wildcard. This mismatch in pattern matching between Spring Security and Spring MVC can potentially allow unauthorized access to protected resources.
Vulnerability Detail
The vulnerability arises from an inconsistency in pattern matching between Spring Security and Spring MVC when using the mvcRequestMatcher with the "**" pattern. This mismatch can lead to a security bypass, enabling unauthorized users to access protected resources. The impact of this vulnerability is critical, as it can compromise the confidentiality and integrity of sensitive data. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 9.1, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.3.0, < 5.3.265.3.26 -
>= 6.0.0, < 6.0.76.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to avoid using the "" pattern in the mvcRequestMatcher configuration. Instead, use more specific patterns that accurately match the desired URLs. For example, if the intention is to protect all URLs under the "/admin" path, the pattern "/admin/" can be used. By avoiding the use of the "**" pattern, the mismatch in pattern matching can be mitigated.
Conclusion
The security bypass vulnerability in the Spring Framework can be mitigated by upgrading to the fixed versions or by using a temporary workaround. It is crucial to take immediate action to protect sensitive data and prevent unauthorized access. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring →
FAQ
The vulnerability allows unauthorized users to bypass security measures and gain access to protected resources, potentially compromising sensitive data.
Versions 6.0.0 - 6.0.6 and 5.3.0 - 5.3.25 of the Spring Framework are affected.
To fix this vulnerability, upgrade to the fixed versions of the Spring Framework: 6.0.7 or later for versions 6.0.0 - 6.0.6, and 5.3.26 or later for versions 5.3.0 - 5.3.25.
Yes, as a temporary workaround, avoid using the "**" pattern in the mvcRequestMatcher configuration and use more specific patterns instead.
The CVSS score for this vulnerability is 9.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring.
