Описание
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
A flaw was found in Spring Boot. Under specific conditions, including being a servlet-based web application without custom Spring Security configuration and relying on the default web security filter chain, a remote attacker could bypass security. This allows unauthorized access to all application endpoints, leading to potential information disclosure and circumvention of security controls.
Отчет
This is an Important flaw in Spring Boot that allows security bypass under specific application configurations. When a servlet-based web application lacks custom Spring Security configuration, relies on the default web security filter chain, depends on spring-boot-actuator-autoconfigure, and does not include spring-boot-health, an attacker can gain unauthorized access to all application endpoints. Red Hat JBoss Data Grid (jdg-8.6) is affected by this vulnerability.
Меры по смягчению последствий
To mitigate this flaw, ensure that Spring Boot applications either implement their own Spring Security configuration, thereby not relying on the default web security filter chain, or include a dependency on spring-boot-health. Applications that do not meet all the specific conditions outlined for vulnerability are not affected. If spring-boot-actuator-autoconfigure is not strictly required, consider removing it.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AMQ Broker 7 | spring-boot | Not affected | ||
| Red Hat AMQ Broker 7 | spring-boot-actuator-autoconfigure | Not affected | ||
| Red Hat AMQ Clients | spring-boot | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | spring-boot | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | spring-boot-actuator-autoconfigure | Not affected | ||
| Red Hat build of Apache Camel - HawtIO 4 | spring-boot | Not affected | ||
| Red Hat build of Apache Camel - HawtIO 4 | spring-boot-actuator-autoconfigure | Not affected | ||
| Red Hat build of OptaPlanner 8 | spring-boot | Not affected | ||
| Red Hat Data Grid 8 | spring-boot | Affected | ||
| Red Hat Data Grid 8 | spring-boot-actuator-autoconfigure | Not affected |
Показывать по
Дополнительная информация
Статус:
9.1 Critical
CVSS3
Связанные уязвимости
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Spring Boot's default security filter chain has no authorization rule with Actuator but without Health
9.1 Critical
CVSS3