Description

Spring Framework versions 5.0 to 5.0.4, 4.3 to 4.3.14, and older unsupported versions allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Affected Spring Products and Versions

• Spring Framework 5.0 to 5.0.4
• Spring Framework 4.3 to 4.3.14
• Older unsupported versions are also affected

Mitigation

Users of affected versions should apply the following mitigation:

• 5.0.x users should upgrade to 5.0.5
• 4.3.x users should upgrade to 4.3.15
• Older versions should upgrade to a supported branch

There are no other mitigation steps necessary.

Note also that this attack does not apply to applications that:

• Do not use Windows.
• Do not serve files from the file system, i.e. not using “file:” for the resource location.
• Use Spring Security with versions patched for CVE-2018-1199.

Credit

This issue was identified and responsibly reported by Orange Tsai (@orange_8361) from DEVCORE.

References

• Example <a href='https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#mvc-config-static-resources'&gt;Spring MVC config</a> that enables the serving of static resources.
…

Description

Spring Framework versions 5.0 to 5.0.4, 4.3 to 4.3.14, and older unsupported versions provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

In order for the attacker to succeed, they would have to be able to guess the multipart boundary value chosen by server A for the multipart request to server B, which requires the attacker to also have control of the server or the ability to see the HTTP log of server A through a separate attack vector.

Affected Spring Products and Versions

• Spring Framework 5.0 to 5.0.4
• Spring Framework 4.3 to 4.3.14
• Older unsupported versions are also affected

Mitigation

Users of affected versions should apply the following mitigation:

• 5.0.x users should upgrade to 5.0.5
• 4.3.x users should upgrade to 4.3.15

There are no other mitigation steps necessary.

Credit

This issue was identified and responsibly reported by Philippe Arteau from GoSecure.

History

2018-04-05: Initial vulnerability report published

Description

Cross-site scripting (XSS) vulnerability in the file upload feature of Spring Batch Admin allows a remote attacker to inject arbitrary web script or HTML via a crafted request related to the file upload functionality.

Affected Spring Products and Versions

• Spring Batch Admin all versions

Mitigation

Users of affected versions should apply the following mitigation:

• Spring Batch Admin has reached end of life as of January 1, 2018. Spring Cloud Data Flow is the recommended replacement for managing and monitoring Spring Batch jobs going forward.

Credit

This vulnerability was responsibly reported by Wen Bin Kong.

References

• https://docs.spring.io/spring-batch-admin
• https://github.com/spring-projects/spring-batch-admin/blob/master/MIGRATION.md
…

Description

Spring Batch Admin does not contain Cross Site Request Forgery (CSRF) protection, which may allow an attacker to craft a malicious site that executes requests to Spring Batch Admin.

Affected Spring Products and Versions

• Spring Batch Admin all versions

Mitigation

Users of affected versions should apply the following mitigation:

• Spring Batch Admin has reached end of life as of January 1, 2018. Spring Cloud Data Flow is the recommended replacement for managing and monitoring Spring Batch jobs going forward.

Credit

This vulnerability was responsibly reported by Wen Bin Kong.

References

• https://docs.spring.io/spring-batch-admin
• https://github.com/spring-projects/spring-batch-admin/blob/master/MIGRATION.md
…

Description

Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service[1]. The script included with Spring Boot 1.5.9 and earlier is susceptible to a symlink attack which allows the “run_user” to overwrite and take ownership of any file on the same system.

In order to instigate the attack, the application must be installed as a service and the “run_user” requires shell access to the server.

Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.

[1] https://docs.spring.io/spring-boot/docs/1.5.x/reference/htmlsingle/#deployment-service

Affected Spring Products and Versions

• Spring Boot
  • 1.5.0 - 1.5.9
  • 2.0.0.M1 - 2.0.0.M7
• Older unmaintained versions of Spring Boot were not analyzed and may be impacted.

Mitigation

Users of affected versions should apply the following mitigation:

• 1.5.x users should update to 1.5.10
• 2.0.x pre-release users should update to 2.0.0.RC1

Credit

This issue was identified and reported by Adam Stephens from Oracle Cloud Operations, UK and responsibly reported to Pivotal.

History

2018-01-30: Initial vulnerability report published

Description

Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

Affected Spring Products and Versions

• Spring Security
  • 4.1.0 - 4.1.4
  • 4.2.0 - 4.2.3
  • 5.0.0
• Spring Framework
  • 5.0.0 - 5.0.2
  • 4.3.0 - 4.3.13
• Older unmaintained versions of Spring Security & Spring Framework were not analyzed and may be impacted

Mitigation

Users of affected versions should apply the following mitigation:

• Spring Security<ul><li>5.0.x users should update to 5.0.1</li><li>4.2.x users should update to 4.2.4</li><li>4.1.x users should update to 4.1.5</li></ul>
• Spring Framework<ul><li>5.0.x users should update to 5.0.3</li><li>4.3.x users should update to 4.3.14</li></ul>

As a general precaution, users are encouraged to separate public and private resources. For example, separating static resources and mapping them to /resources/public/** and /resources/private/** is preferred to having one common root with mixed public and private resource content underneath.

Credit

The issue was identified by Macchinetta Framework Development Team from NTT Comware, NTT DATA Corporation, and NTT, and responsibly reported to Pivotal.

History

2018-01-29: Initial…

Description

When connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

Affected Spring Products and Versions

• Spring-LDAP versions 1.3.0 - 2.3.1

Mitigation

Users of affected versions should apply the following mitigation:

• Upgrade to Spring-LDAP version 2.3.2.RELEASE+

Credit

This vulnerability was responsibly reported by Tobias Schneider.

References

• https://github.com/spring-projects/spring-ldap/pull/432
• https://github.com/spring-projects/spring-ldap/issues/430
…

Description

Malicious PATCH requests submitted to servers using Spring Data REST backed HTTP resources can use specially crafted JSON data to run arbitrary Java code.

Affected Spring Products and Versions

• Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1)
• Spring Boot (if Spring Data REST module is used) versions prior to 1.5.9, 2.0 M6

Mitigation

Users of affected versions should apply the following mitigation:

• Releases that have fixed this issue include:<ul><li>Spring Data REST 2.6.9 (Ingalls SR9, Oct. 27th, 2017)</li><li>Spring Data REST 3.0.1 (Kay SR1, Oct. 27th 2017)</li><li>Spring Boot 1.5.9 (Oct, 28th 2017)</li><li>Spring Boot 2.0 M6 (Nov. 6th 2017)</li></ul>

Credit

This vulnerability was responsibly reported by Man Yue Mo from Semmle and lgtm.com.

References

• https://jira.spring.io/browse/DATAREST-1127
• https://jira.spring.io/browse/DATAREST-1152

…

Description

In affected versions of Spring AMQP, a org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.

Affected Spring Products and Versions

• Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7

Mitigation

Users of affected versions should apply the following mitigation:

• Releases that have fixed this issue include:<ul><li>Spring AMQP: 2.0.0, 1.7.4, 1.6.11, 1.5.7</li></ul>

Credit

This vulnerability was responsibly reported by Man Yue Mo from Semmle and lgtm.com.

References

• https://jira.spring.io/browse/AMQP-766
• https://docs.spring.io/spring-amqp/docs/1.6.11.RELEASE/reference/html/_reference.html#_message
…

Description

This CVE addresses a second path to exploiting the same vulnerability as the one described under CVE-2017-4971.

Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e. set to “false”) can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

Affected Spring Products and Versions

• Spring Web Flow 2.4.0 to 2.4.5
• Older unsupported versions are also affected

Mitigation

Users of affected versions should apply the following mitigation:

• 2.4.x users should upgrade to 2.4.6

Note that generally it is a good practice and recommended to always use explicit data binding declarations in view states in order to prevent form submissions from setting fields on the target object that should not be set.

Users of Spring Web Flow with JSF are not impacted by this report.

Credit

The issue was identified by security researcher he1renyagao.

References

• Issue tracker ticket <a href='https://jira.spring.io/browse/SWF-1711'&gt;SWF-1711&lt;/a&gt;.
• Commits <a href='https://github.com/spring-projects/spring-webflow/commit/df0eab'&gt;df0eab&lt;/a> and <a href='https://github.com/spring-projects/spring-webflow/commit/ed5e8c'&gt;ed5e8c&lt;/a…