Spring Framework Vulnerability in libspring-java: Case Sensitivity in Disallowed Fields
Summary
UBUNTU-CVE-2022-22968: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it... Affects libspring-java versions 3.0.6.RELEASE-10 – 3.0.6.RELEASE-9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core component of the Spring Framework, widely used for building enterprise-level applications in Java. It provides comprehensive infrastructure support for developing Java applications, including features for dependency injection, transaction management, and web application development. The framework is known for its flexibility and ease of integration with various technologies. However, it has recently been identified as vulnerable to a case sensitivity issue in its DataBinder component, which can lead to security risks if not addressed.
Vulnerability Detail
The vulnerability, identified as CVE-2022-22968, affects Spring Framework versions 5.3.0 to 5.3.18, 5.2.0 to 5.2.20, and older unsupported versions. The issue arises from the patterns for disallowedFields on a DataBinder being case sensitive. This means that a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including all nested fields within the property path. This oversight can lead to unauthorized access to sensitive data, as attackers may exploit the case sensitivity to bypass security measures.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can manually ensure that all fields listed in disallowedFields are specified in both upper and lower case. However, this is not a permanent solution and should only be used until the package can be updated.
Conclusion
The CVE-2022-22968 vulnerability in the Spring Framework poses a significant risk due to its case sensitivity in disallowedFields. It is crucial for developers using affected versions of libspring-java to update to a patched version to mitigate potential security threats. Temporary workarounds can be applied, but they should not replace a proper update.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2022-22968 is a vulnerability in the Spring Framework that affects the DataBinder's handling of disallowedFields, making it case sensitive.
If your application uses affected versions of the Spring Framework, it may be vulnerable to unauthorized access to sensitive data due to improper field protection.
The vulnerability affects Spring Framework versions 5.3.0 to 5.3.18, 5.2.0 to 5.2.20, and older unsupported versions.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file. Visit Vulert Scanner to check your application without signup.
If immediate updates are not possible, implement the workaround by ensuring that all fields in disallowedFields are specified in both upper and lower case.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
