org.springframework.security:spring-security-oauth2-client@5.3.11.RELEASE vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.security:spring-security-oauth2-client package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Privilege Escalation

Affected versions of this package are vulnerable to Privilege Escalation due to allowing a malicious user or attacker to modify a request initiated by the Client (via the browser) to the Authorization Server. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token response containing an empty scope list on the subsequent request to the token endpoint when trying to obtain the access token.

This vulnerability exposes applications that meet all of the following requirements:

  1. Act in the role of a Login Client (e.g. http.oauth2Login())

  2. Use one or more authorization rules with authorities mapped from authorized scopes (e.g. anyRequest().hasAuthority("SCOPE_message.write")) in the client application

  3. Register an authorization server that responds with empty scopes list (per (RFC 6749, Section 5.1)[https://www.rfc-editor.org/rfc/rfc6749#section-5.1])

This vulnerability does not expose applications that:

  1. Act in the role of a Resource Server only (e.g. http.oauth2ResourceServer())

  2. Use authorization rules with authorities not mapped from authorized scopes (e.g. anyRequest().hasAuthority("ROLE_USER")) in the client application

How to fix Privilege Escalation?

Upgrade org.springframework.security:spring-security-oauth2-client to version 5.4.11, 5.6.9, 5.7.5 or higher.

[,5.4.11) [5.6.0,5.6.9) [5.7.0,5.7.5)