Session Fixation Affecting org.springframework.security:spring-security-config package, versions [5.7.0,5.7.8) [5.8.0,5.8.3) [6.0.0,6.0.3)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-5430965
- published 20 Apr 2023
- disclosed 20 Apr 2023
- credit Daniel Furtlehner
Introduced: 20 Apr 2023
CVE-2023-20862 Open this link in a new tabHow to fix?
Upgrade org.springframework.security:spring-security-config to version 5.7.8, 5.8.3, 6.0.3 or higher.
Overview
org.springframework.security:spring-security-config is a security configuration package for Spring Framework.
Affected versions of this package are vulnerable to Session Fixation due to the logout functionality not properly clearing the security context when using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This allows users to stay authenticated after a logout.
NOTE: Applications are only vulnerable if any of the following conditions are true:
The
SecurityContextHolderFilterorrequireExplicitSave(true)is in use with logout support for serialized sessions, andinvalidateHttpSession(false).Users are logged out manually by saving an empty
SecurityContextinto theHttpSessionSecurityContextRepository.A custom
SecurityContextRepositoryis in use that does not rely on theHttpSession.