Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

It was found that the Spring MVC SourceHttpMessageConverter processed user-provided XML, and did not expose any property for disabling entity resolution in the XML. A remote attacker could use this flaw to conduct XML External Entity (XXE) attacks on web sites, and read files in the context of the user running the application server. The patch for this flaw disables external entity processing by default, and provides a configuration directive to re-enable it. This flaw is considered to be the result of an incomplete fix for CVE-2013-4152.

End of life: 7/31/2027, Latest version: 4.1.0

Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.

Malicious PATCH requests submitted to servers using Spring Data REST backed HTTP resources can use specially crafted JSON data to run arbitrary Java code.

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).

Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.

An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.

A cross-site scripting flaw was found in the Spring Framework when using Spring MVC. From the original advisory:

"When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form."

This issue affects versions 3.0.0 to 3.2.7, and versions 4.0.0 to 4.0.1.

(the fix is present in version 3.2.8; this was incorrect in the gopivotal flaw - chazlett)

External References:

http://www.gopivotal.com/security/cve-2014-1904

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.

A flaw was found in Spring Security in combination with Spring Framework versions prior to 5.0.6 contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

References: https://pivotal.io/security/cve-2018-1258

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.

Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Latest version: 4.3.5

End of life: 7/31/2027, Latest version: 7.0.8

End of life: 12/31/2026, Latest version: 4.0.7

End of life: 7/31/2026, Latest version: 4.2.9

Impact

Installations which use the GitLab auth connector are vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another GitLab user who is granted access to a Concourse team by having their full name listed under users in the team configuration or given to the --gitlab-user flag.

See the GitLab auth docs for details.

Concourse installations which do not configure the GitLab auth connector are not affected.

Patches

Concourse v6.3.1 and v6.4.1 were both released with a fix on August 4th, 2020.

Both versions change the GitLab connector to use the username, rather than the full name. This was always the intent, and the previous behavior was originally reported as a bug (concourse/dex#7) prior to being reported as a security issue.

Any Concourse teams which configure GitLab users will have to switch each user from their full name to their username upon upgrading to these versions.

Workarounds

GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.

References

concourse/dex#12: PR with the fix

For more information

If you have any questions or comments about this advisory, you may reach us privately at concourseteam+security@gmail.com.

It was found that the org.spring.web.util.JavaScriptUtils.javaScriptEscape method insufficiently escaped some characters. Applications using this method to escape user-supplied content that will be rendered in HTML 5 documents may expose cross-site scripting (XSS) flaws.

End of life: 6/30/2026, Latest version: 3.5.16

An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The gfsh (Geode Shell) endpoint, used by operators and application developers to connect to their cluster, is unauthenticated and publicly accessible. Because HTTPS communications are terminated at the gorouter, communications from the gorouter to GemFire clusters are unencrypted. An attacker could run any command available on gfsh and could cause denial of service, lost confidentiality of data, escalate privileges, or eavesdrop on other communications between the gorouter and the cluster.

Impact For some Post/Put Concourse endpoint containing :teamname in the URL, a Concourse user can send a request with body including :teamname=team2 to bypass team scope check to gain access to certain resources belong to any other team. The user only needs a valid user session and belongs to team2.

Exploitable endpoints: {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/jobs/:jobname/builds/:buildname", Method: "POST", Name: RerunJobBuild}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/jobs/:jobname/pause", Method: "PUT", Name: PauseJob}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/jobs/:jobname/unpause", Method: "PUT", Name: UnpauseJob}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/jobs/:jobname/schedule", Method: "PUT", Name: ScheduleJob},

{Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/pause", Method: "PUT", Name: PausePipeline}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/unpause", Method: "PUT", Name: UnpausePipeline}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/expose", Method: "PUT", Name: ExposePipeline}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/hide", Method: "PUT", Name: HidePipeline}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/rename", Method: "PUT", Name: RenamePipeline}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/archive", Method: "PUT", Name: ArchivePipeline},

{Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/resources/:resourcename/versions/:resourceconfigversionid/enable", Method: "PUT", Name: EnableResourceVersion}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/resources/:resourcename/versions/:resourceconfigversionid/disable", Method: "PUT", Name: DisableResourceVersion}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/resources/:resourcename/versions/:resourceconfigversionid/pin", Method: "PUT", Name: PinResourceVersion}, {Path: "/api/v1/teams/:teamname/pipelines/:pipelinename/resources/:resourcename/unpin", Method: "PUT", Name: UnpinResource}, {Path: "/api/v1/teams/:teamname/artifacts", Method: "POST", Name: CreateArtifact},

Steps to reproduce

1. Set up a Concourse deployment with team 1 (with pipeline 1) and team 2. User is in team 2 but not team 1. 2. Login as user to team 2. fly -t ci login -n team2 -u user -p password 3. Try pausing pipeline 1 in team 1 using fly. Verify the command output is pipeline 'pipeline1' not found. fly -t ci pause-pipeline -p pipeline1

4. Send a customized request through fly curl command intend to pause pipeline 1 again. fly -t ci curl /api/v1/teams/team1/pipelines/pipeline1/pause -- -X PUT -d ":teamname=team2" -H "Content-type: application/x-www-form-urlencoded" 5. pipeline 1 in team 1 will be paused.

In step 4, the parameter pollution would allow an user from any team to pause a pipeline that belongs to other team.

Patches Concourse v6.7.9 and v7.8.3 were both released with a fix on October 12, 2022.

Instead of using FormValue to parse teamname in the request, where allows body parameters to take precedence over URL query string values, both patch versions are now using URL.Query().Get() over multiple scope handlers to prevent the parameter pollution.

Workarounds No known workarounds for existing versions.

References https://github.com/concourse/concourse/pull/8566: PR with the fix

For more information If you have any questions or comments about this advisory, you may reach us privately at security@concourse-ci.org.

End of life: 1/30/2026, Latest version: 4.1.8

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.

RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could carry out a local binary hijacking (planting) attack and execute arbitrary code.

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.