Replay Attack Affecting org.springframework.ws:spring-ws-security package, versions [,4.1.4)[5.0.0-M1,5.0.2)

Affected versions of this package are vulnerable to Replay Attack due to the Wss4jSecurityInterceptor class in Wss4jSecurityInterceptor.java not consistently wiring configured Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, replay protections for UsernameToken nonces and creation timestamps, Timestamp elements, and SAML one-time-use semantics are ineffective even when an operator configures a replay cache on the interceptor. An attacker who captures a valid SOAP message can re-submit it and have it accepted again, re-triggering the authenticated operation.

Note:

This is only exploitable if the attacker first captures still-valid cryptographic material and replays it within the message's acceptance window against a deployment that relies on WSS4J replay detection.

If upgrading is not possible, enable a replay cache by extending Wss4jSecurityInterceptor and overriding initializeValidationRequestData(MessageContext messageContext):

protected RequestData initializeValidationRequestData(MessageContext messageContext) {
    RequestData requestData = super.initializeValidationRequestData(messageContext);
    // Create ReplayCache according to your deployment scenario
    requestData.setNonceReplayCache(replayCache);
    requestData.setTimestampReplayCache(replayCache);
    requestData.setSamlOneTimeUseReplayCache(replayCache);
    return requestData;
}

• GitHub Commit
• Spring Security Advisory