PT-2024-19292 · Spring · Spring Authorization Server

Pieter Philippaerts · Published 2024-03-19 · Updated 2024-12-05 · CVE-2024-22258

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Authorization Server versions 1.0.0 through 1.0.5 Spring Authorization Server versions 1.1.0 through 1.1.5 Spring Authorization Server versions 1.2.0 through 1.2.2 Spring Authorization Server older unsupported versions

Description The issue concerns a PKCE Downgrade Attack for Confidential Clients. An application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. However, an application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

Recommendations For Spring Authorization Server versions 1.0.0 through 1.0.5, consider disabling the use of PKCE for the Authorization Code Grant by Confidential Clients until a patch is available. For Spring Authorization Server versions 1.1.0 through 1.1.5, consider disabling the use of PKCE for the Authorization Code Grant by Confidential Clients until a patch is available. For Spring Authorization Server versions 1.2.0 through 1.2.2, consider disabling the use of PKCE for the Authorization Code Grant by Confidential Clients until a patch is available. For Spring Authorization Server older unsupported versions, consider upgrading to a supported version and then disabling the use of PKCE for the Authorization Code Grant by Confidential Clients until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-470

Related Identifiers

CVE-2024-22258

GHSA-X637-X8P3-5P22

Affected Products

Spring Authorization Server

References · 11

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22258 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-22258 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x637-x8p3-5p22 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22258 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-22258 · Security Note
• https://github.com/spring-projects/spring-authorization-server/commit/a7035d22bd2de6c24e7125623d38fb83d8f659a9 · Note
• https://twitter.com/CVEnew/status/1770304149080465477 · Twitter Post
• https://spring.io/security/cve-2024-22258 · Note
• https://twitter.com/RedPacketSec/status/1770753778641252738 · Twitter Post
• https://t.me/cvenotify/103213 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1770321720026505592 · Twitter Post