CVE-2022-31692: Critical severity VMware Spring Security vulnerability
A flaw was found in the spring-security framework. Spring Security could allow a remote attacker to bypass security restrictions caused by an issue when using forward or include dispatcher types. By sending a specially-crafted request, an attacker can bypass authorization rules.
Other sources
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 0:2.387.1.1680701869-1.el8 - Upgrade
Upgrade
redhat/spring securityto a version that resolves this vulnerability.Fixed in 5.7.5 - Upgrade
Upgrade
redhat/spring securityto a version that resolves this vulnerability.Fixed in 5.6.9 - Upgrade
Upgrade
spring-securityto a version that resolves this vulnerability.Fixed in 5.7.5 - Upgrade
Upgrade
spring-securityto a version that resolves this vulnerability.Fixed in 5.6.9 - Configuration
In the application configuration, change spring.security.filter.dispatcher-types from including forward and/or include (e.g., request, error, async, forward, include) to only request, error, async so that FilterChainProxy is not applied to forward/include dispatcher types.
Spring Security spring.security.filter.dispatcher-types = request, error, async - Compensating control
Ensure Spring Security is not configured to apply authorization/FilterChainProxy to forward and/or include dispatcher types (e.g., avoid authorizeHttpRequests().shouldFilterAllDispatcherTypes(true) and dispatcher types that include forward/include) so that forward/include requests cannot bypass authorization rules.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-31692?
CVE-2022-31692 is a vulnerability found in the Spring Security framework that allows a remote attacker to bypass authorization rules.
How severe is CVE-2022-31692?
CVE-2022-31692 has a severity rating of 9.8 (critical).
Which versions of Spring Security are affected by CVE-2022-31692?
Spring Security versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 are affected by CVE-2022-31692.
How can CVE-2022-31692 be exploited?
CVE-2022-31692 can be exploited by leveraging forward or include dispatcher types to bypass authorization rules.
Where can I find more information about CVE-2022-31692?
More information about CVE-2022-31692 can be found at the following references: - [CVE Website](https://www.cve.org/CVERecord?id=CVE-2022-31692) - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-31692) - [Spring Security Advisory](https://spring.io/security/cve-2022-31692) - [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2162206) - [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2023:3954)