Vulnerability · Published Jul 17, 2023 · Assigned by vmware
CVE-2023-34036Forwarded header exploit with Spring HATEOAS on WebFlux
Medium 5.3
In plain English
A medium-severity security flaw in Spring HATEOAS from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.hateoas:spring-hateoas | 1.5.5 | GHSA-7m5c-fgwf-mwph |
| Maven | org.springframework.hateoas:spring-hateoas | 2.0.5 | GHSA-7m5c-fgwf-mwph |
| Maven | org.springframework.hateoas:spring-hateoas | 2.1.1 | GHSA-7m5c-fgwf-mwph |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring HATEOAS | 1.5.4 or older2.0.4 or older2.1.0 |
Weakness: CWE-644 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N