PT-2018-13185 · Spring · Spring Security Oauth

Alvaro Muñoz + 1 · Published 2018-10-18 · Updated 2019-10-03 · CVE-2018-15758

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Security OAuth versions 2.0 prior to 2.0.16 Spring Security OAuth versions 2.1 prior to 2.1.3 Spring Security OAuth versions 2.2 prior to 2.2.3 Spring Security OAuth versions 2.3 prior to 2.3.4

Description The issue allows a malicious user to craft a request to the approval endpoint, potentially leading to a privilege escalation on subsequent approval. This can occur when the application is configured to use a custom approval endpoint that declares AuthorizationRequest as a controller method argument, and the application acts in the role of an Authorization Server.

Recommendations For Spring Security OAuth versions 2.0 prior to 2.0.16, update to version 2.0.16 or later. For Spring Security OAuth versions 2.1 prior to 2.1.3, update to version 2.1.3 or later. For Spring Security OAuth versions 2.2 prior to 2.2.3, update to version 2.2.3 or later. For Spring Security OAuth versions 2.3 prior to 2.3.4, update to version 2.3.4 or later. As a temporary workaround, consider disabling the custom approval endpoint that declares AuthorizationRequest as a controller method argument until a patch is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2018-15758

GHSA-H8W4-QV99-F7VJ

Affected Products

Spring Security Oauth

References · 12

• https://access.redhat.com/errata/RHSA-2019:2413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15758 · Security Note
• https://pivotal.io/security/cve-2018-15758 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h8w4-qv99-f7vj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15758 · Vendor Advisory
• https://github.com/spring-attic/spring-security-oauth/commit/623776689fdcc8047f5a908c71f348e1f172a97 · Note
• https://github.com/spring-attic/spring-security-oauth/commit/ddd65cd9417ae1e4a69e4193a622300db38e2ef · Note
• https://github.com/spring-attic/spring-security-oauth/commit/4082ec7ae3d39198a47b5c803ccb20dacefb0b0 · Note
• https://github.com/spring-attic/spring-security-oauth/commit/f92223afc71687bd3156298054903f50aa71fbf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15758 · Note
• https://github.com/advisories/GHSA-h8w4-qv99-f7vj · Note
• http://securityfocus.com/bid/105687 · Note