CVE-2023-34034

Overview

Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications, including reactive applications built on Spring WebFlux.

An authorization bypass vulnerability (CVE-2023-34034) has been identified in Spring Security's WebFlux configuration, which allows attackers to reach endpoints that the application is meant to protect. When a pathMatchers rule uses a pattern without a leading slash, such as "**", Spring Security and Spring WebFlux can disagree about which requests the pattern matches, so authorization rules may not be applied to requests that WebFlux still routes to a handler.

Per OWASP: Access control, sometimes called authorization, is how a web application grants access to content and functions to some users and not others. These checks are performed after authentication, and govern what ‘authorized’ users are allowed to do.

This issue affects multiple versions of Spring Security.

‍

Details

Module Info

• Product: Spring Security
• Affected packages: org.springframework.security:spring-security-config
• Affected versions: >=5.6.0 <5.6.12, >=5.7.0 <5.7.10, >=5.8.0 <5.8.5, >=6.0.0 <6.0.5, >=6.1.0 <6.1.2
• GitHub repository: https://github.com/spring-projects/spring-security
• Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-config
• Package manager: Maven
• Fixed in:
  
  • OSS Spring Security 5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2
  • NES for Spring Security v5.5.14

Vulnerability Info

This Critical-severity vulnerability is found in the org.springframework.security:spring-security-config package in multiple versions of Spring Security. In a WebFlux application, authorization rules are declared through ServerHttpSecurity.authorizeExchange(), whose pathMatchers(...) methods are inherited from AbstractServerWebExchangeMatcherRegistry. Those methods pass the raw pattern strings straight to ServerWebExchangeMatchers.pathMatchers:

public T pathMatchers(HttpMethod method, String... antPatterns) {
	return matcher(ServerWebExchangeMatchers.pathMatchers(method, antPatterns));
}

public T pathMatchers(String... antPatterns) {
	return matcher(ServerWebExchangeMatchers.pathMatchers(antPatterns));
}

Each string then becomes a PathPatternParserServerWebExchangeMatcher, which parses it with a private parser of its own instead of the parser Spring WebFlux uses for request mappings:

private static final PathPatternParser DEFAULT_PATTERN_PARSER = new PathPatternParser();

public PathPatternParserServerWebExchangeMatcher(String pattern, HttpMethod method) {
	Assert.notNull(pattern, "pattern cannot be null");
	this.pattern = DEFAULT_PATTERN_PARSER.parse(pattern);
	this.method = method;
}

The pattern is never normalized into a full path pattern, so a pattern that lacks a leading slash, such as "**" or "user/**", is compiled as written. Request paths always start with /, so such a pattern can fail to match requests that the developer intended it to cover. A rule such as .pathMatchers("admin/**").hasRole("ADMIN") may then never fire, and the request falls through to a later, more permissive rule while WebFlux still dispatches it to the protected handler. Because the security matcher also ignores parser settings the application configured for WebFlux, the two components can disagree on further paths. An unauthenticated remote attacker who sends requests to the affected paths can reach functionality that the authorization rules were meant to restrict.

‍

Mitigation

Only recent versions of Spring Security receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Security.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• tkswifty (finder)
• Ha1c9on (finder)