Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Actuator CloudFoundry endpoints. An attacker can gain unauthorized access to protected endpoints by sending requests to application endpoints declared under the CloudFoundry Actuator path.

Note:

This is only exploitable if all of the following conditions are met:

• the application is a web application

• the application contributes an application endpoint that requires authentication under a subpath, like "/cloudfoundryapplication/admin"

Remediation

Upgrade org.springframework.boot:spring-boot-actuator to version 3.5.12, 4.0.4 or higher.

References

• GitHub Commit
• Spring Advisory

Overview

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the configuration of endpoints under paths already assigned to Health Group additional paths. An attacker can gain unauthorized access to protected endpoints by sending requests to these specific paths.

Note:

This is only exploitable if all of the following conditions are met:

• the application declares a custom health group (here "mygroup"), with management.endpoint.health.group.mygroup.include

• this health group is exposed under an additional path on the main server, like management.endpoint.health.group.mygroup.additional-path=server:/healthz

• the application contributes an application endpoint that requires authentication under a subpath, like "/healthz/admin"

Mapping application endpoints under infrastructure endpoints like Actuators is not recommended by the Spring team and doing so is likely to interfere with other configurations and cause behavior problems. This setup is expected to rarely occur in production.

Remediation

Upgrade org.springframework.boot:spring-boot-actuator to version 3.5.12, 4.0.4 or higher.

References

• GitHub Commit
• Spring Advisory

Overview

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Actuator CloudFoundry endpoints. An attacker can gain unauthorized access to protected endpoints by sending requests to application endpoints declared under the CloudFoundry Actuator path.

Note:

This is only exploitable if all of the following conditions are met:

• the application is a web application

• the application contributes an application endpoint that requires authentication under a subpath, like "/cloudfoundryapplication/admin"

Remediation

Upgrade org.springframework.boot:spring-boot-actuator-autoconfigure to version 3.5.12, 4.0.4 or higher.

References

• GitHub Commit
• Spring Advisory

Overview

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the configuration of endpoints under paths already assigned to Health Group additional paths. An attacker can gain unauthorized access to protected endpoints by sending requests to these specific paths.

Note:

This is only exploitable if all of the following conditions are met:

• the application declares a custom health group (here "mygroup"), with management.endpoint.health.group.mygroup.include

• this health group is exposed under an additional path on the main server, like management.endpoint.health.group.mygroup.additional-path=server:/healthz

• the application contributes an application endpoint that requires authentication under a subpath, like "/healthz/admin"

Mapping application endpoints under infrastructure endpoints like Actuators is not recommended by the Spring team and doing so is likely to interfere with other configurations and cause behavior problems. This setup is expected to rarely occur in production.

Remediation

Upgrade org.springframework.boot:spring-boot-actuator-autoconfigure to version 3.5.12, 4.0.4 or higher.

References

• GitHub Commit
• Spring Advisory