Описание
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
A flaw was found in Spring Framework. A Spring MVC application utilizing UrlFileNameViewController with an end-of-path mapping and no configured prefix is susceptible to an open redirect vulnerability. This could allow an attacker to redirect users to arbitrary malicious websites, potentially leading to phishing attacks or other social engineering exploits.
Отчет
An open redirect vulnerability exists in Spring Web MVC when UrlFileNameViewController is configured with an end-of-path mapping and lacks a defined prefix. An unauthenticated remote attacker can exploit this by enticing a user to follow a specially crafted URL, leading to an external redirection to an arbitrary domain. Because redirection occurs entirely within the context of browser navigation and application-level routing, default system isolation mechanisms like SELinux or non-root container boundaries do not mitigate the flaw. Technical impact is limited to phishing and user redirection without direct impact to server integrity or confidentiality.
Меры по смягчению последствий
Configure explicit prefixes for UrlFileNameViewController mappings, or enforce strict URL validation using an explicit path-prefix or custom view resolver to prevent unauthenticated arbitrary external redirects.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel - HawtIO 4 | spring-webmvc | Fix deferred | ||
| Red Hat Enterprise Linux 8 | pki-core:10.6/resteasy | Fix deferred | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/resteasy | Fix deferred | ||
| Red Hat Enterprise Linux 9 | resteasy | Fix deferred | ||
| Red Hat Fuse 7 | spring-webmvc | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | devspaces/openvsx-rhel9 | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | devspaces/pluginregistry-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.4 Medium
CVSS3
Связанные уязвимости
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
A Spring MVC application that uses UrlFileNameViewController that is m ...
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
5.4 Medium
CVSS3