CVE-2022-22978: Authorization Bypass in RegexRequestMatcher

HIGH | MAY 16, 2022 | CVE-2022-22978

Description

In Spring Security versions 5.4.10, 5.5.6, and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers.

Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Affected Spring Products and Versions

Spring Security
- 5.4.x prior to 5.4.11
- 5.5.x prior to 5.5.7
- 5.6.x prior to 5.6.4
- Earlier unsupported versions

Mitigation

Users should update to a version that includes fixes. 5.5.x users should upgrade to 5.5.7 or greater. 5.6.x users should upgrade to 5.6.4 or greater. Releases that have fixed this issue include:

Spring Security
- 5.4.11+
- 5.5.7+
- 5.6.4+
- 5.7+

Credit

This vulnerability was discovered and responsibly reported by Hiroki Nishino, Toshiki Sasazaki, Yoshinori Hayashi, and Jonghwan Kim from LINE Corporation.