Privilege Escalation Affecting org.springframework.security:spring-security-oauth2-client package, versions [,5.4.11) [5.6.0,5.6.9) [5.7.0,5.7.5)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.25% (66th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-3092127
  • published 1 Nov 2022
  • disclosed 1 Nov 2022
  • credit Tobias Soloschenko, Apache Software Foundation

How to fix?

Upgrade org.springframework.security:spring-security-oauth2-client to version 5.4.11, 5.6.9, 5.7.5 or higher.

Overview

Affected versions of this package are vulnerable to Privilege Escalation due to allowing a malicious user or attacker to modify a request initiated by the Client (via the browser) to the Authorization Server. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token response containing an empty scope list on the subsequent request to the token endpoint when trying to obtain the access token.

This vulnerability exposes applications that meet all of the following requirements:

  1. Act in the role of a Login Client (e.g. http.oauth2Login())

  2. Use one or more authorization rules with authorities mapped from authorized scopes (e.g. anyRequest().hasAuthority("SCOPE_message.write")) in the client application

  3. Register an authorization server that responds with empty scopes list (per (RFC 6749, Section 5.1)[https://www.rfc-editor.org/rfc/rfc6749#section-5.1])

This vulnerability does not expose applications that:

  1. Act in the role of a Resource Server only (e.g. http.oauth2ResourceServer())

  2. Use authorization rules with authorities not mapped from authorized scopes (e.g. anyRequest().hasAuthority("ROLE_USER")) in the client application

CVSS Scores

version 3.1
Expand this section

Snyk

8.1 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    None
Expand this section

NVD

8.1 high
Expand this section

Red Hat

8.1 high