Overview
Spring Security is a complete framework that provides authentication, authorization, and other security features for Java applications, particularly those built with the Spring Framework.
An Authentication Bypass vulnerability (CVE-2024-22234) has been identified in Spring Security's spring-security-web module, which allows attackers to bypass authentication mechanisms by taking advantage of improper handling of null authentication parameters.
Per OWASP: "Authentication bypass occurs when an attacker is able to gain access to a system without having valid credentials, often due to flaws in the authentication mechanism."
This issue affects versions 6.1.0 to 6.1.6 and 6.2.0 to 6.2.1 of Spring Security's spring-security-web module.
Details
Module Info
- Product: Spring Security
- Affected packages: spring-security-core
- Affected versions: <6.1.7, >=6.2.0 <6.2.2
- GitHub repository: https://github.com/spring-projects/spring-security
- Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-web
- Package manager: Maven
- Fixed in: Spring Security 6.1.7 and 6.2.2
Vulnerability Info
CVE-2024-22234 is a high-severity vulnerability found in Spring Security's spring-security-web module versions 6.1.0 to 6.1.6 and 6.2.0 to 6.2.1. The issue arises when the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method is called with a null authentication parameter, leading to an incorrect true return value. This flaw allows attackers to bypass authentication checks, potentially granting unauthorized access to sensitive resources.
Mitigation
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Security.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credits
- This vulnerability was reported by Rogério Sorroche.
