VMware Spring Security up to 5.6.8/5.7.4 Dispatcher Type authorizeHttpRequests improper authorization

Summaryinfo

A vulnerability has been found in VMware Spring Security up to 5.6.8/5.7.4 and classified as critical. This issue affects the function authorizeHttpRequests of the component Dispatcher Type Handler. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2022-31692. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in VMware Spring Security up to 5.6.8/5.7.4. It has been rated as critical. This issue affects the function authorizeHttpRequests of the component Dispatcher Type Handler. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)

The weakness was shared 11/01/2022. It is possible to read the advisory at tanzu.vmware.com. The identification of this vulnerability is CVE-2022-31692 since 05/25/2022. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 5.6.9 or 5.7.5 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• VMware

Name

• Spring Security

Version

• 5.6.0
• 5.6.1
• 5.6.2
• 5.6.3
• 5.6.4
• 5.6.5
• 5.6.6
• 5.6.7
• 5.6.8
• 5.7.0
• 5.7.1
• 5.7.2
• 5.7.3
• 5.7.4

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion