Case-sensitive Disallowed Fields in Spring Framework
Summary
CVE-2022-22968: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it... Affects libspring-java versions < 927b8c15ef20eaaa4002d4b2170cc536a6d6aa35. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The libspring-java package in Debian is a distribution-specific package that includes the Spring Framework. This vulnerability affects versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions of the Spring Framework.
Vulnerability Detail
The vulnerability (CVE-2022-22968) arises from the case sensitivity of the patterns for disallowedFields on a DataBinder in the Spring Framework. This means that a field is not effectively protected unless it is listed with both upper and lower case for the first character, including all nested fields within the property path. An attacker could exploit this vulnerability to bypass field restrictions and potentially manipulate or access unauthorized data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by ensuring that disallowedFields patterns are defined in a case-insensitive manner. This can be achieved by using case-insensitive regular expressions or converting field names to a consistent case before applying the disallowedFields pattern.
Conclusion
The case-sensitive disallowedFields vulnerability in the Spring Framework can be mitigated by upgrading to the latest secure version and ensuring that disallowedFields patterns are defined in a case-insensitive manner. Developers should review their code and follow best practices to protect against unauthorized data manipulation or access. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libspring-java →
FAQ
The vulnerability allows attackers to bypass field restrictions, potentially leading to unauthorized data manipulation or access.
Versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions are affected.
There are no known exploits for this vulnerability at the time of this report.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
You can find more information about this vulnerability in the CVE-2022-22968 JSON report available at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-22968.json
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
