Cross Site Tracing Vulnerability in libspring-java: HTTP Method Manipulation Risk
Summary
CVE-2018-11039: Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the Hid... Affects libspring-java across 2 version ranges.
< 4.3.19-1
< 8dab9416c7381a477c5b5f94da421da9eb976735
Fixed in 4.3.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core component of the Spring Framework, widely used for building Java applications. It provides comprehensive infrastructure support for developing Java applications, including web applications. The framework's features include dependency injection, aspect-oriented programming, and a robust MVC architecture. However, certain versions of libspring-java are vulnerable to an HTTP method manipulation issue, which can lead to serious security risks if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2018-11039, allows web applications using the HiddenHttpMethodFilter in Spring MVC to change the HTTP request method to any method, including TRACE. This can be exploited by attackers if there is a pre-existing XSS vulnerability in the application, leading to a Cross Site Tracing (XST) attack. This vulnerability affects versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18, among older unsupported versions. The potential ramifications include unauthorized access to sensitive information and the ability to execute malicious scripts.
How To Fix
Minimum fixed version
4.3.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling the HiddenHttpMethodFilter in your application temporarily. This can be done by removing or commenting out the filter configuration in your Spring MVC setup. However, this is only a temporary measure and should not replace a proper upgrade.
Conclusion
CVE-2018-11039 presents a significant risk to applications using vulnerable versions of libspring-java. It is crucial to upgrade to the fixed version to mitigate the risk of HTTP method manipulation and potential XST attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2018-11039 is a vulnerability in the Spring Framework that allows HTTP method manipulation, potentially leading to Cross Site Tracing attacks.
Versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 are affected, along with older unsupported versions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2018-11039 is 5.9, indicating a moderate level of severity.
If you cannot upgrade immediately, consider disabling the HiddenHttpMethodFilter as a temporary workaround until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
