Описание
Authorization bypass in Spring Security
In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2022-22978
- https://github.com/anchore/grype/issues/2158
- https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java
- https://security.netapp.com/advisory/ntap-20220707-0003
- https://spring.io/security/cve-2022-22978
- https://tanzu.vmware.com/security/cve-2022-22978
- https://www.oracle.com/security-alerts/cpujul2022.html
Пакеты
org.springframework.security:spring-security-core
>= 5.5.0, < 5.5.7
5.5.7
org.springframework.security:spring-security-core
>= 5.6.0, < 5.6.4
5.6.4
org.springframework.security:spring-security-core
< 5.4.11
5.4.11
org.springframework.security:spring-security-web
>= 5.5.0, < 5.5.7
5.5.7
org.springframework.security:spring-security-web
>= 5.6.0, < 5.6.4
5.6.4
org.springframework.security:spring-security-web
< 5.4.11
5.4.11
Связанные уязвимости
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and olde ...
Уязвимость компонента RegexRequestMatcher Java-фреймворка для обеспечения безопасности промышленных приложений Spring Security, позволяющая нарушителю повысить свои привилегии