Spring Framework versions 5.0 to 5.0.4, 4.3 to 4.3.14, and older unsupported versions provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

In order for the attacker to succeed, they would have to be able to guess the multipart boundary value chosen by server A for the multipart request to server B, which requires the attacker to also have control of the server or the ability to see the HTTP log of server A through a separate attack vector.

• Spring Framework 5.0 to 5.0.4
• Spring Framework 4.3 to 4.3.14
• Older unsupported versions are also affected

Users of affected versions should apply the following mitigation:

• 5.0.x users should upgrade to 5.0.5
• 4.3.x users should upgrade to 4.3.15

There are no other mitigation steps necessary.

This issue was identified and responsibly reported by Philippe Arteau from GoSecure.