This page lists Spring advisories.
CVE-2020-5413: Kryo Configuration Allows Code Execution with Unknown “Serialization Gadgets”
CVE-2020-5411: Jackson Configuration Allows Code Execution with Unknown “Serialization Gadgets”
Description
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets".
Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true:
- Spring Batch’s Jackson support is being leveraged to serialize a job’s ExecutionContext.
- A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored).
In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown “deserialization gadgets” when enabling default typing.
Affected Spring Products and Versions
- Spring Batch
- 4.0.0 to 4.0.4
- 4.1.0 to 4.1.4
- 4.2.0 to 4.2.2
Mitigation
Users of an affected version should upgrade to 4.2.3 or later. Releases that have fixed this issue include:
- Spring Batch
- 4.2.3
Credit
This issue was identified and responsibly reported by Srikanth…
CVE-2020-5410: Directory Traversal with spring-cloud-config-server
CVE-2020-5407: Signature Wrapping Vulnerability with spring-security-saml2-service-provider
CVE-2020-5408: Dictionary attack with Spring Security queryable text encryptor
CVE-2020-5403: DoS Via Malformed URL with Reactor Netty HTTP Server
Description
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
Affected Spring Products and Versions
- Reactor Netty
- 0.9.3
- 0.9.4
Mitigation
Users of affected versions should upgrade to 0.9.5 (reactor-bom Dysprosium SR-5). No other steps are necessary.
- Reactor Netty
- 0.9.5
Credit
This issue was…
CVE-2020-5404: Authentication Leak On Redirect With Reactor Netty HttpClient
CVE-2020-5405: Directory Traversal with spring-cloud-config-server
CVE-2020-5398: RFD Attack via “Content-Disposition” Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
Description
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header in the response
where the filename attribute is derived from user supplied input.
Specifically, an application is vulnerable when all of the following are true:
- The header is prepared with org.springframework.http.ContentDisposition.
-
The filename is set via one of:
- ContentDisposition.Builder#filename(String), or
- ContentDisposition.Builder#filename(String, US_ASCII)
- The value for the filename is derived from user supplied input.
- The user supplied input is not sanitized by the application.
- The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details).
An application is not vulnerable if any of the following is true:
- The application does not set a “Content-Disposition” response header.
- The header is not prepared with org.springframework.http.ContentDisposition.
- The filename is set via one of:
- ContentDisposition.Builder#filename(String, UTF_8), or
- ContentDisposition.Builder#filename(String, ISO_8859_1)
- The filename is not derived from user supplied input.
- The filename is derived from user supplied input but sanitized by the application.
Affected Spring Products and Versions
- Spring Framework
- 5.2.0 to 5.2.2
- 5.1.0 to 5.1.12
- 5.0.0 to 5.0.15
Mitigation
Users of affected versions should apply the following mitigation. 5.2.x users should upgrade to 5.2.3. 5.1.x users should upgrade to 5.1.13. 5.0.x users should upgrade to 5.0.16. No other steps are necessary. Releases that have fixed this issue include:
- Spring Framework
- 5.2.3
- 5.1.13
- 5.0.16
Credit
This issue was identified and responsibly reported by Roman Shalymov from EPAM.
References
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy