Spring Security vulnerabilities

The ActiveDirectoryLdapAuthenticator in Spring Security versions 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds, it may incorrectly authenticate a user who supplies an empty password.

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Affected versions include Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18, 5.8.0-5.8.27, and 5.7.0-5.7.25.

Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as internal (private) or external (public). Affects Spring Security 7.1.0.

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.

Spring Security Authorization Server versions 7.1.0 and 7.0.0-7.0.6 are vulnerable because the default consent page renders user-controlled values without HTML entity encoding.

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Affected versions include Spring Security 5.7.0 through 7.1.0.

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Affected versions: Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18.

Authentication Bypass by Capture-replay vulnerability in Spring Security allows Spring Security's DPoPProofJwtDecoderFactory to contain a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs.

The SubjectDnX509PrincipalExtractor in Spring Security does not correctly handle certain malformed X.509 certificate CN values, potentially reading the wrong username. A crafted certificate could allow an attacker to impersonate another user. Affected versions: 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, 6.5.0-6.5.10.

A vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache stores the full absolute pre-authentication URL in a browser cookie. After login, the user is redirected to this URL without validation, enabling an open redirect attack.

Vulnerability in Spring Security SAML allows attackers to decrypt SAML Responses and LogoutRequest/LogoutResponse elements without a valid signature, enabling the Service Provider to be used as a decryption oracle. Affects versions 5.7.0-5.7.23, 5.8.0-5.8.25, 6.3.0-6.3.16, 6.4.0-6.4.16, 6.5.0-6.5.10, 7.0.0-7.0.5.

In Spring Security, an attacker able to influence values in RelyingPartyRegistration can execute arbitrary code on HTML forms generated by Spring Security filters. Affected versions: 5.7.0-5.7.23, 5.8.0-5.8.25, 6.3.0-6.3.16, 6.4.0-6.4.16, 6.5.0-6.5.10, and 7.0.0-7.0.5.

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository can store malicious serialized payloads in columns containing verification or encryption credentials. Affects Spring Security versions 7.0.0 through 7.0.5.

An application using spring-security-saml2-service-provider with the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

A vulnerability in Spring Security allows authorization rules to be bypassed when an application uses <sec:intercept-url servlet-path="..."/> to define the servlet path. The servlet path is not included in path matching, leading to authorization bypass.

A vulnerability in Spring Security affects applications that configure JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder and must separately configure an OAuth2TokenValidator<Jwt>, for example by calling setJwtValidator. The issue affects Spring Security versions 6.3.0 through 6.3.14, 6.4.0 through 6.4.14, 6.5.0 through 6.5.9, and 7.0.0 through 7.0.4.

A vulnerability in Spring Security's SubjectX500PrincipalExtractor incorrectly handles malformed CN values in X.509 certificates, potentially reading the wrong username. A crafted certificate could allow an attacker to impersonate another user.

In Spring Security, if an application uses the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes to enable, expire, or lock users, DaoAuthenticationProvider's timing attack defense can be bypassed for disabled, expired, or locked users. This affects Spring Security 5.7.0 through 5.7.22, 5.8.0 through 5.8.24, 6.3.0 through 6.3.15, 6.5.0 through 6.5.9, and 7.0.0 through 7.0.4.

Vulnerability in Spring Security affects applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService. A Time-of-check Time-of-use (TOCTOU) race condition may lead to improper functioning of the one-time token mechanism.

A vulnerability in Spring Security allows bypassing access control when the application directly calls the AuthenticatedVoter#vote method with a null Authentication parameter. Affected versions are 5.7.x up to 5.7.11, 5.8.x up to 5.8.10, 6.0.x up to 6.0.8, 6.1.x up to 6.1.7, and 6.2.x up to 6.2.2.

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet.