Find, fix and prevent vulnerabilities in your code.

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._removeUnwantedIgnorals process. An attacker can access or modify properties that were intended to be ignored by supplying JSON input with keys matching the renamed property names, thereby bypassing intended access restrictions.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups for chosen hostnames by submitting JSON that is deserialized into a type holding an InetSocketAddress field, with no authentication required. The observable effect is limited to DNS resolution of attacker-chosen names, useful for out-of-band interaction or internal resolver probing rather than a full outbound request, and it applies only where the application deserializes untrusted JSON into types containing such fields.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the STD_INET_ADDRESS branch in FromStringDeserializer in src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java. An attacker can trigger outbound DNS lookups and blind SSRF behavior by supplying a hostname string in JSON that is deserialized into java.net.InetAddress. When application code binds untrusted input into an InetAddress field or type, the deserializer calls InetAddress.getByName(value) on the attacker-controlled string and resolves it before any application validation runs. This lets an attacker force DNS-based callbacks or probe internal hostnames, causing unwanted network egress and leaking resolver-visible information.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

• GitHub Commit jackson-databind-2.21.1
• GitHub Commit jackson-databind-3.2.1
• Maintainer's Advisory

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') through NioPathDeserializer in src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java. An attacker can force readValue() to resolve an attacker-controlled java.nio.file.Path URI by supplying a non-file scheme such as jar:, http:, s3:, or a custom provider scheme in untrusted JSON. That input reaches new URI(value) and then Path.of(uri), which falls back to ServiceLoader<FileSystemProvider> resolution and can invoke a matching provider’s getPath(uri) during deserialization. The result is unintended provider loading and provider-driven path handling inside the application, which can trigger denial of service or other side effects depending on what FileSystemProvider implementations are present on the classpath.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.

Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the connection-scoped _trailers handling in the HTTP/1.1 request processing path. An attacker can expose stale trailer fields to a later request on the same keep-alive connection by sending a request with trailers and then a follow-on request without them. The server reuses the same HttpConnection state across requests, so application code that reads request.getTrailers() on the second request can see trailer data from the first request. This can cause incorrect request handling and leakage of request metadata between requests handled on the same connection.

Remediation

Upgrade org.eclipse.jetty:jetty-server to version 12.0.36, 12.1.10 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitLab Work Item
• Maintainer's Advisory

Overview

org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input through ComplianceUtils.verify(HttpURI, HttpFields, HttpCompliance, ComplianceViolation.Listener) in jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/ComplianceUtils.java. An attacker can bypass host consistency checks by sending a request whose :authority pseudo-header and Host header name different hosts, causing Jetty to accept the request and expose conflicting host identities to different code paths. This lets attacker-controlled host information survive inside the request, so logic that relies on Request.getServerName() or the URI authority can see one host while code reading the raw Host header sees another. In deployments that use host-based routing, ACLs, redirects, or tenant isolation, this can lead to incorrect request handling, host-based access control bypass, and attacker-influenced URL generation or logging.

Notes

• HTTP/1.1 already had its own authority/Host consistency path in HttpConnection/HttpChannelState; the gap was in the HTTP/2 and HTTP/3 server entry flow where the shared compliance check was invoked before that comparison happened.
• The mismatch check only rejects when both values are present and differ after normalizing case and default ports, so requests with only one of :authority or Host present are not part of this issue.

Remediation

Upgrade org.eclipse.jetty:jetty-server to version 9.4.61, 10.0.29, 11.0.29, 12.0.35, 12.1.9 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub PR
• GitHub PR
• GitHub PR
• GitLab Work Item
• Maintainer's Advisory

Overview

org.eclipse.jetty:jetty-util is a Web Container & Clients - supports HTTP/2, HTTP/1.1, HTTP/1.0, websocket, servlets, and more.

Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions due to incorrect handling of ; path-parameter segments in the canonicalization loop. An attacker can bypass path-based security checks or reach protected content by sending a request such as /public;/../admin/secret, which leaves the .. segment unnormalized when the path is matched against constraints like SecurityHandler.PathMapped. When the semicolon segment is followed by / and then . or .., the parser carries forward a stale slash state and returns a non-normalized canonical path. That can let requests intended for a protected prefix such as /admin/* be treated as outside the protected path, resulting in unauthorized access to resources that should require authentication.

Remediation

Upgrade org.eclipse.jetty:jetty-util to version 12.0.35, 12.1.9 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• Maintainer's Advisory

Overview

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via static resource resolution. An attacker can cause denial of service by sending crafted requests that are slow to resolve when accessing file-system-backed static resources, causing HTTP connections to remain occupied and exhausting server resources.

Note: This is only exploitable if all the following are true:

1. The application uses Spring MVC or Spring WebFlux.

2. Static resources are served from the file system.

3. The application is running on Windows.

Remediation

Upgrade org.springframework:spring-core to version 6.2.18, 7.0.7 or higher.

References

• GitHub Commit
• spring Security Advisory

Overview

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via Spring Expression Language (SpEL) method invocation handling. An attacker can invoke arbitrary zero-argument methods by supplying crafted SpEL expressions, even in contexts intended to restrict method execution or provide read-only access. This may allow execution of unintended application logic and access to functionality that should not be exposed through expression evaluation.

Note: This is only exploitable if the application accepts and evaluates untrusted or user-controlled SpEL expressions.

Remediation

Upgrade org.springframework:spring-expression to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to HTTP Request Smuggling. via multipart request parsing discrepancies between Spring MVC/WebFlux and intermediary security devices. An attacker can bypass Web Application Firewall (WAF) or proxy security controls by sending crafted multipart requests that are interpreted differently by the intermediary and the Spring application, allowing malicious content to evade inspection and reach the backend application.

Remediation

Upgrade org.springframework:spring-webmvc to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit

• GitHub Release

• GitHub Release

• Spring Security Advisory

Overview

com.hazelcast:hazelcast is a clustering and highly scalable data distribution platform.

Affected versions of this package are vulnerable to Improper Access Control due to inadequate permission checking, within the SQL mapping for the CSV File Source connector. This could enable unauthorized clients to access data from files stored on a member's filesystem.

Workaround

This vulnerability can be avoided by disabling the Hazelcast Jet processing engine in Hazelcast member configuration - which will result in SQL and Jet jobs not working.

Remediation

Upgrade com.hazelcast:hazelcast to version 5.2.5, 5.3.5 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

com.hazelcast:hazelcast is a clustering and highly scalable data distribution platform.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the ConfigXmlGenerator component due to improper password masking in the member configurations. Exploiting this vulnerability allows Hazelcast Management Center users to view members' secrets.

Remediation

Upgrade com.hazelcast:hazelcast to version 5.1.6, 5.3.0 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• PoC

Overview

ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in HardenedObjectInputStream, whose resolveClass allowlist admitted any class whose name starts with java.lang or java.util rather than matching specific authorized classes. An attacker can instantiate dangerous classes such as java.lang.ProcessBuilder during deserialization, reaching remote code execution through a gadget chain, by delivering a malicious serialized object to a logback component that deserializes it, such as its socket receiver for serialized logging events (SocketNode). Exploitation requires the application to deserialize attacker-controlled serialized data through logback, in practice via its socket-based receiver, together with a usable gadget class on the classpath.

Workaround

This vulnerability can be avoided by not exposing logback's socket-based serialized receivers, such as SocketReceiver and ServerSocketReceiver, to untrusted networks, which removes the path by which attacker-controlled serialized objects reach the deserialization filter.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade ch.qos.logback:logback-classic to version 1.5.33 or higher.

References

• Apache Jira Issues
• GitHub Commit
• Release Notes

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in HardenedObjectInputStream, whose resolveClass allowlist admitted any class whose name starts with java.lang or java.util rather than matching specific authorized classes. An attacker can instantiate dangerous classes such as java.lang.ProcessBuilder during deserialization, reaching remote code execution through a gadget chain, by delivering a malicious serialized object to a logback component that deserializes it, such as its socket receiver for serialized logging events (SocketNode). Exploitation requires the application to deserialize attacker-controlled serialized data through logback, in practice via its socket-based receiver, together with a usable gadget class on the classpath.

Workaround

This vulnerability can be avoided by not exposing logback's socket-based serialized receivers, such as SocketReceiver and ServerSocketReceiver, to untrusted networks, which removes the path by which attacker-controlled serialized objects reach the deserialization filter.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.5.33 or higher.

References

• Apache Jira Issues
• GitHub Commit
• Release Notes

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType() method of DefaultBaseTypeLimitingValidator, whose denylist of unsafe base types omits java.lang.Comparable, so the method returns true for any subtype resolved under a Comparable base. An attacker can trigger instantiation of arbitrary classes that implement Comparable, such as java.io.File to reach path-traversal primitives, by sending JSON with attacker-controlled type identifiers. This requires the application to use a bare @JsonTypeInfo with the default validator and no explicit PolymorphicTypeValidator, and a property or class whose declared base type is Comparable.

Workaround

This vulnerability can be avoided by configuring an explicit restrictive PolymorphicTypeValidator, such as a BasicPolymorphicTypeValidator allowlist passed to activateDefaultTyping(), instead of relying on the default validator.

Note: The discoverer of this vulnerability reports that "I have not identified a class implementing Comparable that yields code execution purely through deserialization".

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via pattern processing in AntPathMatcher. An attacker can cause denial of service by supplying a crafted regular expression pattern to methods such as match(), matchStart(), or extractUriTemplateVariables(), triggering excessive backtracking and CPU consumption during pattern evaluation.

Note: This is only exploitable if attacker-controlled input is used directly or indirectly as the pattern argument to one of the affected AntPathMatcher methods.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

• A The string must start with the letter 'A'
• (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
• D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

1. CCC
2. CC+C
3. C+CC
4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade org.springframework:spring-core to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to HTTP Response Splitting via the Content-Disposition header when untrusted input is used to construct its value. An attacker can inject malicious characters to break the HTTP header or corrupt the framing of an outbound multipart body by supplying specially crafted file names or values.

Note: This is only exploitable if the application uses non-default or legacy HTTP connectors that do not reject malicious characters in header values, or if untrusted input is used to set the Content-Disposition of a part in an outbound multipart request body.

Remediation

Upgrade org.springframework:spring-web to version 7.0.9 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via incorrect host parsing in UriComponentsBuilder. An attacker can perform server-side request forgery by supplying a crafted URL that is interpreted differently than intended during validation, allowing requests to be sent to unintended hosts despite application-level hostname validation checks.

Remediation

Upgrade org.springframework:spring-web to version 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Information Exposure in the DaoAuthenticationProvider component. An attacker can determine the status of user attributes such as enabled, expired, or locked by analyzing response times, potentially allowing user attribute enumeration through timing analysis.

Remediation

Upgrade org.springframework.security:spring-security-core to version 6.5.10, 7.0.5 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the JdbcOneTimeTokenService component. An attacker can gain unauthorized access to multiple sessions by reusing a single one-time token during authentication.

Note:

This is only exploitable if the application is explicitly configured to use One-Time Token login with JdbcOneTimeTokenService.

Remediation

Upgrade org.springframework.security:spring-security-core to version 6.5.10, 7.0.5 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when sending view fragments over Server-Sent Events (SSE). An attacker can cause data streams to be corrupted and potentially inject malicious information to other users by controlling the data that is streamed to clients.

Note: This is only exploitable if the application uses Spring MVC or Spring WebFlux, sends view fragments via SSE, and the attacker can control the streamed data.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.

References

• Spring Security Advisory

Overview

org.freemarker:freemarker is a "template engine"; a generic tool to generate text output (anything from HTML to auto generated source code) based on templates.

Affected versions of this package are vulnerable to Relative Path Traversal through the ClassTemplateLoader and WebappTemplateLoader template-loading paths. An attacker can force loading of templates outside the intended base package or webapp subdirectory by supplying a malformed locale or template name that backs out with .. segments, causing FreeMarker to resolve unintended resources during localized lookup. This can let the attacker read templates or other loader-backed resources the configured TemplateLoader can reach, breaking application rendering and exposing content that should not be selected by template lookup.

Workarounds

• Disable localized lookup in FreeMarker configurations that are still on affected versions; this prevents the malformed-locale path traversal from being exercised during template lookup.

Remediation

Upgrade org.freemarker:freemarker to version 2.3.35 or higher.

References

• Apache Security Advisory
• GitHub Commit

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via improper escaping in JavaScriptUtils.javaScriptEscape(). An attacker can inject arbitrary JavaScript code into a web page when user-controlled input is escaped using javaScriptEscape() and subsequently embedded into a JavaScript context. Incorrect escaping may allow malicious input to break out of the intended context and execute in the victim's browser.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade org.springframework:spring-web to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Open Redirect in the UrlHandlerFilter process when it is configured with very broadly matching patterns. An attacker can redirect users to arbitrary external sites by crafting a specially constructed URL.

Remediation

Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.

References

• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via user-controlled values in the cssClass, cssErrorClass, or cssStyle attributes of JSP <form:*> tags. An attacker can inject arbitrary HTML or JavaScript into rendered pages by supplying crafted values for these attributes, potentially leading to cross-site scripting (XSS) and execution of malicious code in the browser of affected users.

Note: This is only exploitable if the application uses user-controlled input to populate the affected JSP form tag attributes.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade org.springframework:spring-webmvc to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Open Redirect via view resolution for "/**" mappings without an explicitly specified view name. An attacker can trigger an open redirect by crafting a URL that causes the application to interpret user-controlled input as a view name with the redirect: prefix, resulting in a redirect to an arbitrary external host.

Note: In Spring MVC applications with the same configuration, an attacker can also trigger an internal forward using the forward: prefix.

Remediation

Upgrade org.springframework:spring-webmvc to version 6.0.0, 6.2.19, 7.0.8 or higher.

References

• GitHub Commit
• GitHub Release
• GitHub Release
• Spring Security Advisory

Overview

org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.

Affected versions of this package are vulnerable to Open Redirect in the UrlFileNameViewController file when it is mapped with an end-of-path and lacks a configured prefix. An attacker can redirect users to arbitrary external URLs by crafting a specially constructed request.

Remediation

Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Open Redirect in the CookieRequestCache function. An attacker can redirect users to arbitrary external sites by crafting a malicious authentication flow that leverages the unvalidated absolute URL stored in the cookie.

Note:

This is only exploitable if all the following conditions are met:

• The application uses CookieRequestCache (Servlet) or CookieServerRequestCache (WebFlux) as its RequestCache implementation.

• An attacker is able to influence the value of the REDIRECT_URI cookie, for example through cookie injection via a related subdomain, an HTTP response splitting attack, or a protocol downgrade from HTTPS to HTTP.

Remediation

Upgrade org.springframework.security:spring-security-web to version 6.5.11, 7.0.6 or higher.

References

• GitHub Commit
• Spring Security Advisory

Dual license: EPL-1.0, LGPL-2.1

Dual license: EPL-1.0, LGPL-2.1