When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) error in Jaxb2RootElementHttpMessageConverter when processing XML data. By sending specially-crafted XML data, an attacker could exploit this vulnerability to read arbitrary files and obtain sensitive information.

It was found that Spring MVC processed user-provided XML with JAXB, in combination with a StAX XMLInputFactory, without disabling external entity resolution. A remote attacker could use this flaw to conduct XML External Entity (XXE) attacks on web sites, and read files in the context of the user running the application server. This flaw affects Spring Framework 3.2.x before 3.2.4 and 4.0.0.M1 through 4.0.0.M2.

It was reported [1] that the Spring Framework suffered from several XML External Entity (XXE) flaws:

Versions Affected: - 3.0.0 to 3.2.3 (Spring OXM) - 3.2.0 to 3.2.3 (Spring MVC) - 4.0.0.M1 (Spring OXM) - 4.0.0.M1-4.0.0.M2 (Spring MVC) - Earlier unsupported versions may also be affected

Description: The Spring OXM wrapper did not expose any property for disabling entity resolution when using the JAXB unmarshaller. There are four possible source implementations passed to the unmarshaller: - DOMSource - StAXSource - SAXSource - StreamSource For a DOMSource, the XML has already been parsed by user code and that code is responsible for protecting against XXE. For a StAXSource, the XMLStreamReader has already been created by user code and that code is responsible for protecting against XXE. For SAXSource and StreamSource instances, Spring processed external entities by default thereby creating this vulnerability. The issue was resolved by disabling external entity processing by default and adding an option to enable it for those users that need to use this feature when processing XML from a trusted source.

It was also identified that Spring MVC processed user provided XML with JAXB in combination with a StAX XMLInputFactory without disabling external entity resolution. External entity resolution has been disabled in this case.

Mitigation: Users of affected versions should apply the following mitigation: - Users of 3.x should upgrade to 3.2.4 or later - Users of 4.x should upgrade to 4.0.0.RC1 or later once released Note the Spring OXM issue is fixed in 4.0.0.M2

[1] http://seclists.org/bugtraq/2013/Aug/154

External References:

http://www.gopivotal.com/security/cve-2013-4152 https://github.com/SpringSource/spring-framework/pull/317 https://jira.springsource.org/browse/SPR-10806

Spring Framework could allow a remote attacker to obtain sensitive information, caused by an error when handling the Expression Language. An attacker could exploit this vulnerability to obtain classpaths and other sensitive information.

VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application.

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1622 to the following vulnerability:

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

References: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1622 [2] http://www.securityfocus.com/archive/1/511877 [3] http://www.exploit-db.com/exploits/13918 [4] http://www.springsource.com/security/cve-2010-1622 [5] http://www.securityfocus.com/bid/40954

Credit: The issue was discovered by Meder Kydyraliev, Google Security Team

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1622 to the following vulnerability:

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

References: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1622 [2] http://www.securityfocus.com/archive/1/511877 [3] http://www.exploit-db.com/exploits/13918 [4] http://www.springsource.com/security/cve-2010-1622 [5] http://www.securityfocus.com/bid/40954

Credit: The issue was discovered by Meder Kydyraliev, Google Security Team

Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified "input fields."

Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do. NOTE: some of these details are obtained from third party information.

Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information.

CVE-2009-1190: Spring Framework Remote Denial of Service vulnerability

Severity: Low

Vendor: SpringSource

Versions Affected: Spring Framework 1.1.0-2.5.6, 3.0.0.M1-3.0.0.M2 dm Server 1.0.0-1.0.2 (note 2.x not affected since dm Server 2.x requires a 1.6 JDK)

Description: The j.u.r.Pattern.compile method in Sun 1.5 JDK has a problem ([1],[2]) with exponential compilation times, when using optional groups. A workaround [3] was

implemented in 1.4.206 but the root cause of poor performance in regex processing was not resolved until JDK 1.6. JdkRegexpMethodPointcut calls Pattern.compile(source[i]); via it's inherited readObject method (from AbstractRegexpMethodPointcut). When Sun JVM 1.5 driven application with spring.jar in its classpath accepts serializable data, an attacker could use a long

regex string with many optional groups to consume enormous CPU resources. And, with a few requests all listeners will be occupied with compiling regex

expressions forever.

Mitigation: - Users of all products may upgrade to JRE/JDK 1.6 which includes the fix for the root cause - Spring Framework 2.5.6.SEC01 has been released for Community users that includes a workaround to the root cause - Spring Framework 2.5.6.SR2 is available for Enterprise users that includes a workaround to the root cause - Disable functionality that accepts serializable data from untrusted sources - dm Server 1.0.3 that includes a workaround to the root cause will be released shortly - Instrumented Spring Framework 2.5.6.SR2 that includes a workaround to the root cause will be released shortly

Example: public class DoSSpring {

static byte[] getSerialized(Object o) throws Exception { ByteArrayOutputStream baos = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(baos); oos.writeObject(o); oos.flush(); oos.close(); return baos.toByteArray(); }

public static void main(String[] a) throws Exception{ String thePattern="(Y)?(K)?(W)?(I)?(U)?(G)?(S)?(E)?(Q)?(C)?(O)?(A)?(M)?(Y)" + "?(K)?(W)?(I)?(U)?(G)?(S)?(E)?(Q)?(C)?(O)?(A)?(M)?(Y)?(K)" + "?(W)?(I)?(U)?(a)?$"; String longerPattern = thePattern.substring(0,thePattern.length()-1)+thePattern; int length = longerPattern.length(); String fakePattern = longerPattern.replaceAll(".", "A"); JdkRegexpMethodPointcut jrmp = new JdkRegexpMethodPointcut(); jrmp.setPattern(fakePattern); System.out.println(jrmp); byte[] theArray = getSerialized(jrmp); int i = 0; for (; i< theArray.length;i++) { if (((char)theArray[i])=='A' &&((char)theArray[i+1]=='A')) { break; } } System.arraycopy(longerPattern.getBytes(), 0, theArray, i, length); ByteArrayInputStream bis = new ByteArrayInputStream(theArray); ObjectInputStream ois = new ObjectInputStream(bis); Object o = ois.readObject(); // returns after a very very long time } }

Credit: This issue was discovered by the RedHat Security Response Team

References: [1] http://www.packetstormsecurity.org/hitb06/DAY1-MarcSchoenefeld-PentestingJavaJ2EE.pdf [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2540 [3] http://archive.cert.uni-stuttgart.de/uniras/2005/01/msg00035.html

Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.