CVE-2022-31690

Overview

Spring Security is a comprehensive authentication and access-control framework for Java applications. It is the standard for securing Spring-based applications, providing support for OAuth2, SAML, and other authentication protocols.

An Incorrect Privilege Assignment vulnerability (CVE-2022-31690) has been identified in Spring Security's spring-security-oauth2-client module, which handles OAuth2 login and client functionality.

An Incorrect Privilege Assignment vulnerability occurs when a system assigns broader privileges to an actor than what was intended or authorized. In this case, the Spring Security OAuth2 client incorrectly defaults to the client registration's configured scopes when the authorization server's token response contains an empty scope list. This means the client application may grant a user privileges based on its own configuration rather than what the authorization server actually authorized, leading to a privilege escalation.

This issue affects multiple versions of Spring Security's spring-security-oauth2-client package.

‍

Details

Module Info

• Product: Spring Security
• Affected packages: spring-security-oauth2-client
• Affected versions: >= 5.7.0 < 5.7.5, < 5.6.9
• GitHub repository: https://github.com/spring-projects/spring-security
• Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-oauth2-client
• Package manager: Maven
• Fixed In: NES for Spring Security v5.5.9

‍

Vulnerability Info

This flaw affects Spring Security applications that rely on the OAuth2 client module to authenticate users and enforce scope-based access control. Under specific conditions, the client may end up operating with broader privileges than the authorization server intended to grant.

The vulnerability is triggered when the following conditions are present:

• The application is configured as an OAuth2 login client
• Access control decisions in the application depend on authorities derived from OAuth2 scopes
• The authorization server omits or returns an empty scope field in its access token response (which is permitted by the OAuth 2.0 specification RFC 6749, Section 5.1)

When the token response lacks explicit scopes, the affected versions of spring-security-oauth2-client substitute the scopes from the application's own client registration. As a result, the authenticated session may carry authorities that were never granted by the authorization server, bypassing intended access restrictions.

‍

Mitigation

Only recent versions of Spring Security are community-supported. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of Spring Security
• Leverage a commercial support partner like HeroDevs for post-EOL security support.