PT-2021-14855 · Spring · Spring Cloud Netflix Zuul

Threedr3Am · Published 2021-02-23 · Updated 2021-05-10 · CVE-2021-22113

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Cloud Netflix Zuul versions 2.2.6.RELEASE and below

Description The issue allows bypassing the "Sensitive Headers" restriction when executing requests with specially constructed URLs. Applications using Spring Security's StrictHttpFirewall are not affected, as they reject requests that allow bypassing.

Recommendations For Spring Cloud Netflix Zuul versions 2.2.6.RELEASE and below, consider disabling the "Sensitive Headers" functionality until a patch is available. As a temporary workaround, enable Spring Security's StrictHttpFirewall to reject requests that allow bypassing the "Sensitive Headers" restriction. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-22113

GHSA-VWPG-F6GW-RJVF

Affected Products

Spring Cloud Netflix Zuul

References · 8

• https://osv.dev/vulnerability/GHSA-vwpg-f6gw-rjvf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22113 · Security Note
• https://tanzu.vmware.com/security/cve-2021-22113 · Vendor Advisory
• https://github.com/spring-cloud/spring-cloud-netflix/commit/8ecb3dca511c3ce0454e42ac31ee2331d7318c07 · Note
• https://t.me/cvenotify/10354 · Telegram Post
• https://t.me/cibsecurity/24012 · Telegram Post
• https://t.me/cvenotify/10724 · Telegram Post