Unauthorized Access with Spring Security Method Security

CRITICAL | MAY 09, 2018 | CVE-2018-1258

Description

Spring Security in combination with Spring Framework 5.0.5.RELEASE contain an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

Affected Spring Products and Versions

Spring Framework:

5.0.5.RELEASE - 5.0.5.RELEASE

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Fix version	Availability
5.0.6.RELEASE	OSS

Users leveraging Spring Framework 5.x should avoid using Spring Framework 5.0.5.RELEASE. Updating to Spring Security 5.0.5.RELEASE+ or Spring Boot 2.0.2.RELEASE+ brings in Spring Framework 5.0.6.RELEASE+ transitively. However, users should be certain that other dependency management mechanisms are also updated to use Spring Framework 5.0.6.RELEASE or newer.
Users leveraging Spring Framework 4.x (Spring Security 4.x or Spring Boot 1.x) are not impacted so no steps are necessary.
There are no other mitigation steps required.