Cross-Domain Request Vulnerability in libspring-java: JSONP Exposure
Summary
CVE-2018-11040: Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpRespons... Affects libspring-java across 2 version ranges.
< 4.3.19-1
< 8dab9416c7381a477c5b5f94da421da9eb976735
Fixed in 4.3.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core component of the Spring Framework, widely used for building Java-based web applications. It provides comprehensive infrastructure support for developing Java applications, including RESTful services. The framework is designed to facilitate the development of robust, maintainable applications, but certain configurations can inadvertently expose applications to security risks, such as cross-domain requests.
Vulnerability Detail
The vulnerability, identified as CVE-2018-11040, affects versions of the Spring Framework prior to 5.0.7 and 4.3.18. It allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice and MappingJackson2JsonView. Although these features are not enabled by default, if MappingJackson2JsonView is configured, JSONP support becomes available through the 'jsonp' and 'callback' parameters, potentially allowing unauthorized access to sensitive data across domains.
How To Fix
Minimum fixed version
4.3.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider disabling JSONP support in your application by removing any configurations related to MappingJackson2JsonView or ensuring that it is not used in your REST controllers.
Conclusion
CVE-2018-11040 presents a significant risk to applications using vulnerable versions of libspring-java by allowing unauthorized cross-domain requests. It is crucial for developers to update their libraries to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for libspring-java →
FAQ
JSONP (JSON with Padding) is a technique used to request data from a server in a different domain than the client, which can lead to security vulnerabilities if not properly managed.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can allow attackers to make unauthorized cross-domain requests, potentially leading to data leakage or unauthorized access to sensitive information.
This vulnerability is specific to certain versions of the Spring Framework and is not uncommon in web applications that utilize JSONP without proper security measures.
The CVSS score for CVE-2018-11040 is 7.5, indicating a high severity level that requires prompt attention.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
