PT-2018-10937 · Spring · Spring Security+1

Published 2018-03-16 · Updated 2022-06-23 · CVE-2018-1199

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Security versions 4.1.x through 4.1.4 Spring Security versions 4.2.x through 4.2.3 Spring Security versions 5.0.x through 5.0.0 Spring Framework versions 4.3.x through 4.3.13 Spring Framework versions 5.0.x through 5.0.2

Description The issue arises from the handling of URL path parameters in security constraints. By utilizing special encodings in URL path parameters, an attacker may bypass security constraints. This is due to the inconsistent handling of path parameters by different Servlet containers, which either include or exclude them from the value returned for getPathInfo(). As a result, secured Spring MVC static resource URLs can be bypassed using different character encodings in path parameters.

Recommendations For Spring Security versions 4.1.x through 4.1.4, update to version 4.1.5 or later. For Spring Security versions 4.2.x through 4.2.3, update to version 4.2.4 or later. For Spring Security versions 5.0.x through 5.0.0, update to version 5.0.1 or later. For Spring Framework versions 4.3.x through 4.3.13, update to version 4.3.14 or later. For Spring Framework versions 5.0.x through 5.0.2, update to version 5.0.3 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-1199

GHSA-V596-FWHQ-8X48

Affected Products

Spring Framework

Spring Security

References · 25

• https://access.redhat.com/errata/RHSA-2018:2405 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1199 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1199 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1199 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1199 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v596-fwhq-8x48 · Vendor Advisory
• https://pivotal.io/security/cve-2018-1199 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1199 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1199 · Vendor Advisory
• https://github.com/spring-projects/spring-framework/commit/73a81f98d40eb6f5faa91aceb868db53fae2a94b · Note
• https://github.com/spring-projects/spring-framework/commit/e6e6b8f4adcad99d133de97fcfac5ae5dd14153c · Note
• https://github.com/spring-projects/spring-framework/commit/554662ebab87af97ba25d0c9f5449c7acda8df9c · Note
• https://github.com/spring-projects/spring-security/commit/65da28e4bf62f58fb130ba727cbbd621b44a36d · Note
• https://github.com/spring-projects/spring-security/commit/0eef5b4b425ab42b9fa0fde1a3f36a37b92558f · Note