CVE-2023-34036: Forwarded header exploit with Spring HATEOAS on WebFlux
First published: Mon Jul 17 2023(Updated: )
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server. For the application to be affected, it needs to satisfy the following requirements: * It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
Credit: security@vmware.com security@vmware.com security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vmware Spring Hateoas | <1.5.5 | |
| Vmware Spring Hateoas | >=2.0.0<2.0.5 | |
| Vmware Spring Hateoas | =2.1.0 | |
| Vmware Spring Hateoas | =2.1.0-milestone1 | |
| Vmware Spring Hateoas | =2.1.0-rc1 | |
| maven/org.springframework.hateoas:spring-hateoas | >=2.1.0<2.1.1 | 2.1.1 |
| maven/org.springframework.hateoas:spring-hateoas | >=2.0.0<2.0.5 | 2.0.5 |
| maven/org.springframework.hateoas:spring-hateoas | <1.5.5 | 1.5.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-34036?
CVE-2023-34036 is a vulnerability in reactive web applications that use Spring HATEOAS to produce hypermedia-based responses.
What is the severity of CVE-2023-34036?
The severity of CVE-2023-34036 is medium, with a severity value of 5.3.
Which software versions are affected by CVE-2023-34036?
Spring HATEOAS versions 2.1.0-milestone1, 2.1.0-rc1, 2.1.0, 2.0.0 to 2.0.5, and 1.5.5 are affected by CVE-2023-34036.
How can I fix the CVE-2023-34036 vulnerability?
To fix the CVE-2023-34036 vulnerability, update Spring HATEOAS to version 2.1.1 if using versions 2.1.0 to 2.1.0-milestone1, version 2.0.5 if using versions 2.0.0 to 2.0.5, or version 1.5.5 if using versions up to 1.5.5.
Where can I find more information about CVE-2023-34036?
You can find more information about CVE-2023-34036 at the following references: [spring.io](https://spring.io/security/cve-2023-34036), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-34036), [GitHub Advisory](https://github.com/advisories/GHSA-7m5c-fgwf-mwph).
- collector/nvd-latest
- collector/github-advisory
- alias/GHSA-7m5c-fgwf-mwph
- alias/CVE-2023-34036
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/author
- agent/severity
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/vmware
- canonical/vmware spring hateoas
- version/vmware spring hateoas/2.1.0-milestone1
- version/vmware spring hateoas/2.1.0-rc1
- version/vmware spring hateoas/2.1.0
- version/vmware spring hateoas/2.0.0
- package-manager/maven