Vmware Spring Security up to 6.1.1 WebFlux access control

Summaryinfo

A vulnerability classified as critical has been found in Vmware Spring Security up to 5.6.11/5.7.9/5.8.4/6.0.4/6.1.1. This affects an unknown part of the component WebFlux Handler. Performing a manipulation results in access control. This vulnerability is reported as CVE-2023-34034. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Vmware Spring Security up to 5.6.11/5.7.9/5.8.4/6.0.4/6.1.1. This affects some unknown processing of the component WebFlux Handler. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

The weakness was disclosed 07/19/2023. The advisory is shared at spring.io. This vulnerability is uniquely identified as CVE-2023-34034 since 05/25/2023. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/15/2023). MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 5.6.12, 5.7.10, 5.8.5, 6.0.5 or 6.1.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Vmware

Name

• Spring Security

Version

• 5.6.0
• 5.6.1
• 5.6.2
• 5.6.3
• 5.6.4
• 5.6.5
• 5.6.6
• 5.6.7
• 5.6.8
• 5.6.9
• 5.6.10
• 5.6.11
• 5.7.0
• 5.7.1
• 5.7.2
• 5.7.3
• 5.7.4
• 5.7.5
• 5.7.6
• 5.7.7
• 5.7.8
• 5.7.9
• 5.8.0
• 5.8.1
• 5.8.2
• 5.8.3
• 5.8.4
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.1.0
• 6.1.1

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion