VMware Spring HATEOAS up to 1.5.4/2.0.4/2.1.0 on WebFlux Header http headers for scripting syntax

Summaryinfo

A vulnerability, which was classified as critical, was found in VMware Spring HATEOAS up to 1.5.4/2.0.4/2.1.0 on WebFlux. This affects an unknown function of the component Header Handler. The manipulation results in improper neutralization of http headers for scripting syntax. This vulnerability is cataloged as CVE-2023-34036. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in VMware Spring HATEOAS up to 1.5.4/2.0.4/2.1.0 on WebFlux. Affected is some unknown functionality of the component Header Handler. The manipulation with an unknown input leads to a improper neutralization of http headers for scripting syntax vulnerability. CWE is classifying the issue as CWE-644. The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash. This is going to have an impact on integrity. CVE summarizes:

Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.

The weakness was shared 07/17/2023. The advisory is shared for download at spring.io. This vulnerability is traded as CVE-2023-34036 since 05/25/2023. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/17/2023).

Upgrading to version 1.5.5, 2.0.5 or 2.1.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• VMware

Name

• Spring HATEOAS

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 2.0
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.1.0

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion