Security Bypass Vulnerability in libspring-java Package
Summary
DEBIAN-CVE-2023-20860: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spri... Affects libspring-java versions 4.3.30-1 – 4.3.30-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core component of the Spring Framework, widely used for building Java applications. It provides comprehensive infrastructure support for developing Java applications, including web applications. The package is known for its powerful features such as dependency injection, aspect-oriented programming, and transaction management. However, certain configurations can lead to security vulnerabilities, particularly in how patterns are matched in Spring Security.
Vulnerability Detail
The vulnerability, identified as CVE-2023-20860, arises from the use of the pattern '**' in Spring Security configuration with the mvcRequestMatcher. This creates a mismatch in pattern matching between Spring Security and Spring MVC, potentially allowing unauthorized access to resources. Versions affected include Spring Framework 6.0.0 to 6.0.6 and 5.3.0 to 5.3.25. The implications of this vulnerability can lead to security bypass, where attackers may gain access to sensitive endpoints that should be protected.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the pattern '**' in your Spring Security configuration. Instead, specify more restrictive patterns that accurately reflect the intended access control for your application.
Conclusion
The CVE-2023-20860 vulnerability poses a significant risk to applications using the libspring-java package. It is crucial for developers to understand the implications of this vulnerability and take immediate action to update their packages or implement workarounds to secure their applications.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2023-20860 is a security vulnerability in the libspring-java package that allows for potential security bypass due to improper pattern matching in Spring Security.
The affected versions are Spring Framework 6.0.0 to 6.0.6 and 5.3.0 to 5.3.25.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement the workaround by avoiding the use of the pattern '**' in your Spring Security configuration.
More information can be found in the official CVE database and the Debian security advisories related to CVE-2023-20860.
References
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
