Privilege Escalation Affecting org.springframework.security:spring-security-oauth2-client package, versions [,5.4.11) [5.6.0,5.6.9) [5.7.0,5.7.5)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-3092127
- published 1 Nov 2022
- disclosed 1 Nov 2022
- credit Tobias Soloschenko, Apache Software Foundation
Introduced: 1 Nov 2022
CVE-2022-31690 Open this link in a new tabHow to fix?
Upgrade org.springframework.security:spring-security-oauth2-client to version 5.4.11, 5.6.9, 5.7.5 or higher.
Overview
Affected versions of this package are vulnerable to Privilege Escalation due to allowing a malicious user or attacker to modify a request initiated by the Client (via the browser) to the Authorization Server. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token response containing an empty scope list on the subsequent request to the token endpoint when trying to obtain the access token.
This vulnerability exposes applications that meet all of the following requirements:
Act in the role of a Login Client (e.g.
http.oauth2Login())Use one or more authorization rules with authorities mapped from authorized scopes (e.g.
anyRequest().hasAuthority("SCOPE_message.write")) in the client applicationRegister an authorization server that responds with empty scopes list (per (RFC 6749, Section 5.1)[https://www.rfc-editor.org/rfc/rfc6749#section-5.1])
This vulnerability does not expose applications that:
Act in the role of a Resource Server only (e.g.
http.oauth2ResourceServer())Use authorization rules with authorities not mapped from authorized scopes (e.g.
anyRequest().hasAuthority("ROLE_USER")) in the client application