Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data

2022-05-1402:54:56

CWE-502

GitHub Advisory Database

github.com

spring framework

spring security

deserialization

untrusted data

remote attackers

security restrictions

arbitrary commands

software

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.022

Percentile

89.5%

JSON

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

Affected configurations

Vulners

Node

org.springframework.security\Matchspring-security-core

org.springframework\springMatchcore

VendorProductVersionCPE
*org.springframework.security\spring-security-corecpe:2.3:a:*:org.springframework.security\:spring-security-core:*:*:*:*:*:*:*:*
org.springframework\springcorecpe:2.3:a:org.springframework\:spring:core:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	org.springframework.security\	spring-security-core	cpe:2.3:a::org.springframework.security\:spring-security-core::::::::*
org.springframework\	spring	core	cpe:2.3:a:org.springframework\:spring:core::::::::