Vmware Spring Authorization Server up to 1.0.5/1.1.5/1.2.2 PKCE downgrade

Summaryinfo

A vulnerability has been found in Vmware Spring Authorization Server up to 1.0.5/1.1.5/1.2.2 and classified as critical. The impacted element is an unknown function of the component PKCE Handler. This manipulation causes downgrade. This vulnerability is tracked as CVE-2024-22258. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Vmware Spring Authorization Server up to 1.0.5/1.1.5/1.2.2. It has been declared as critical. Affected by this vulnerability is an unknown part of the component PKCE Handler. The manipulation with an unknown input leads to a downgrade vulnerability. The CWE definition for the vulnerability is CWE-757. A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. As an impact it is known to affect confidentiality. The summary by CVE is:

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

It is possible to read the advisory at spring.io. This vulnerability is known as CVE-2024-22258 since 01/08/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1562.010 according to MITRE ATT&CK.

Upgrading to version 1.0.6, 1.1.6 or 1.2.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Vmware

Name

• Spring Authorization Server

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.2.0
• 1.2.1
• 1.2.2

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion