PT-2018-11252 · Spring · Spring Cloud Sso Connector

Published 2018-05-07 · Updated 2022-05-13 · CVE-2018-1256

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Cloud SSO Connector version 2.1.2

Description The issue is related to a regression in the Spring Cloud SSO Connector that disables issuer validation in resource servers not bound to the SSO service. This allows a remote attacker to authenticate to unbound resource servers using tokens generated from another service plan in PCF deployments with multiple SSO service plans.

Recommendations For Spring Cloud SSO Connector version 2.1.2, update to version 2.1.3 to resolve the issue. Alternatively, bind your resource server to the SSO service plan via a service instance binding. Alternatively, set sso.connector.cloud.available=true within your Spring application properties.

Fix

Related Identifiers

CVE-2018-1256

GHSA-Q4Q2-93PW-QWGF

Affected Products

Spring Cloud Sso Connector

References · 5

• https://pivotal.io/security/cve-2018-1256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1256 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1256 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q4q2-93pw-qwgf · Vendor Advisory
• https://github.com/pivotal-cf/spring-cloud-sso-connector/commit/ef647a2acf2363c6018e8543d665ac8862593372 · Note