Security Bypass Vulnerability in Spring Framework
Summary
CVE-2023-20860: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spri... Affects libspring-java versions >= 5acffaa72da10ba42fe547eeea44d8615cbf99b9, < 3540029931c957b646fe219e6c3e713f044ee767. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The framework offers various modules, including Spring Security, which provides authentication and authorization features. The vulnerability affects versions 6.0.0 - 6.0.6 and 5.3.0 - 5.3.25 of the Spring Framework. This vulnerability specifically impacts the Spring Security configuration when using the "**" pattern with the mvcRequestMatcher. The mismatch in pattern matching between Spring Security and Spring MVC can lead to a security bypass.
Vulnerability Detail
The vulnerability (CVE-2023-20860) arises due to the incorrect pattern matching behavior in Spring Security configuration. When the "**" pattern is used with the mvcRequestMatcher, it creates a mismatch between Spring Security and Spring MVC. This mismatch can potentially allow an attacker to bypass security measures. By exploiting this vulnerability, an attacker may gain unauthorized access to protected resources or perform actions that should be restricted. The severity of this vulnerability is rated as high, with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, if upgrading to the patched version is not immediately feasible, it is recommended to avoid using the "**" pattern with the mvcRequestMatcher in the Spring Security configuration. Instead, consider using more specific patterns that accurately match the desired endpoints. By using precise patterns, the mismatch issue can be mitigated.
Conclusion
The security bypass vulnerability in the Spring Framework can lead to unauthorized access and restricted actions. It is crucial to upgrade to the patched versions or apply the recommended workaround to mitigate the risk. Regularly updating the Spring Framework is essential to ensure protection against security vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libspring-java →
FAQ
This vulnerability can potentially allow an attacker to bypass security measures and gain unauthorized access to protected resources or perform restricted actions.
Versions 6.0.0 - 6.0.6 and 5.3.0 - 5.3.25 of the Spring Framework are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the patched versions 6.0.7+ or 5.3.26+ of the Spring Framework.
As a workaround, you can avoid using the "**" pattern with the mvcRequestMatcher in the Spring Security configuration and opt for more specific patterns.
The severity of this vulnerability is rated as high, with a CVSS score of 7.5.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
