Описание
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
A flaw was found in the UrlHandlerFilter component of Spring Framework. When this filter is configured with overly broad patterns, it can be vulnerable to an open redirect. A remote attacker could exploit this by crafting a malicious URL, which, when clicked by a user, redirects them to an arbitrary external website. This could be used in phishing attacks to trick users into revealing sensitive information.
Отчет
A flaw was found in Spring Framework's UrlHandlerFilter. When configured with very broadly matching patterns, the filter can be vulnerable to an open redirect attack. This issue applies to both Spring MVC and Spring WebFlux filter variants. An attacker could craft a malicious URL that, when clicked by a victim, redirects them to an attacker-controlled site. This vulnerability could be exploited in phishing campaigns or to steal authentication tokens in OAuth/SAML flows. Red Hat ships vulnerable versions of Spring Framework in Red Hat build of Apache Camel for Quarkus (Hawtio 4.4) and Red Hat OpenShift Dev Spaces (versions 3.27, 3.28, 3.29, 3.30). Fixed version 7.0.9 is available for the 7.0.x line; the 6.2.x line is End-of-Life and will not receive public updates.
Меры по смягчению последствий
There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. As a temporary workaround, review UrlHandlerFilter configurations and ensure pattern matching is as specific as possible, avoiding overly broad patterns.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel - HawtIO 4 | spring-webmvc | Fix deferred | ||
| Red Hat Enterprise Linux 8 | pki-core:10.6/resteasy | Not affected | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/resteasy | Not affected | ||
| Red Hat Enterprise Linux 9 | resteasy | Not affected | ||
| Red Hat Fuse 7 | spring-webflux | Out of support scope | ||
| Red Hat Fuse 7 | spring-webmvc | Out of support scope | ||
| Red Hat OpenShift Dev Spaces | devspaces/openvsx-rhel9 | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | devspaces/pluginregistry-rhel9 | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | spring-webmvc | Fix deferred | ||
| Red Hat Single Sign-On 7 | spring-webmvc | Out of support scope |
Показывать по
Дополнительная информация
Статус:
5.4 Medium
CVSS3
Связанные уязвимости
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
UrlHandlerFilter can be vulnerable to an open redirect when configured ...
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
5.4 Medium
CVSS3