Spring Security Path Parameter Bypass Vulnerability in libspring-java
Summary
CVE-2018-1199: Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing secu... Affects libspring-java across 3 version ranges.
< 4.3.14-1
>= 62e7762e8f3f2f810b01f2c23f211de627331aa8, < ce8bea69ae7fc83cfd0902a8b3fee2dbe0036ab7
>= b49d801f241fb8088a5b7514db93fda32c58731c, < 8c5588a13b1fdd93cf98faf088a7abc8828bb595
Fixed in 4.3.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a library that provides essential components for building Java applications using the Spring framework. It facilitates the development of secure and robust applications by offering features like authentication, authorization, and protection against common security threats. However, certain versions of this library are vulnerable to a security flaw that allows attackers to bypass security constraints through manipulated URL path parameters.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1199, arises from Spring Security's failure to properly handle URL path parameters when enforcing security constraints. This issue is rooted in ambiguities within the Servlet Specification regarding the treatment of path parameters. As a result, attackers can exploit this flaw by using special encodings in URL path parameters, potentially bypassing security measures intended to protect static resources in Spring MVC applications. The implications of this vulnerability include unauthorized access to sensitive resources, which could lead to data breaches or other malicious activities.
How To Fix
Minimum fixed version
4.3.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional validation on URL parameters within your application to ensure that they do not contain unexpected or malicious encodings. This can help mitigate the risk of bypassing security constraints until an upgrade can be performed.
Conclusion
CVE-2018-1199 represents a significant security vulnerability in libspring-java that can lead to unauthorized access through URL path parameter manipulation. It is crucial for users to upgrade to the fixed versions of the library to ensure the security of their applications. Implementing workarounds can provide temporary relief until an upgrade is feasible.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2018-1199 is a vulnerability in Spring Security that allows attackers to bypass security constraints by manipulating URL path parameters.
Affected versions include Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1, as well as Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-1199 is 5.3, indicating a moderate level of severity.
If an immediate upgrade is not possible, implement additional validation on URL parameters to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
