Vulnerability · Published Oct 28, 2024 · Assigned by vmware
CVE-2024-38821Authorization Bypass of Static Resources in WebFlux Applications
Critical 9.1
In plain English
A critical-severity resource allocation without limits in Spring from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-web | 5.7.13 | GHSA-c4q5-6c82-3qpw |
| Maven | org.springframework.security:spring-security-web | 5.8.15 | GHSA-c4q5-6c82-3qpw |
| Maven | org.springframework.security:spring-security-web | 6.2.7 | GHSA-c4q5-6c82-3qpw |
| Maven | org.springframework.security:spring-security-web | 6.0.13 | GHSA-c4q5-6c82-3qpw |
| Maven | org.springframework.security:spring-security-web | 6.1.11 | GHSA-c4q5-6c82-3qpw |
| Maven | org.springframework.security:spring-security-web | 6.3.4 | GHSA-c4q5-6c82-3qpw |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N