Bug 1564408 (CVE-2018-1272)

Summary:	CVE-2018-1272 spring-framework: Multipart content pollution
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aileenc, alazarot, anstephe, apevec, bmaxwell, cdewolf, chazlett, chrisw, csutherl, darran.lofthouse, dffrench, dimitris, dosoudil, drieden, drusso, etirelli, fgavrilo, gvarsami, gzaronik, hoanhoan9595, ibek, java-maint, java-sig-commits, jawilson, jclere, jcoleman, jjoyce, jmadigan, jolee, jondruse, jpadman, jschatte, jschluet, jshepherd, jstastny, kbasil, kconner, krathod, kverlaen, ldimaggi, lef, lgao, lgriffin, lhh, lpeer, lpetrovi, markmc, mbabacek, mburns, mkolesni, myarboro, ngough, nwallace, paradhya, pgier, pjurak, ppalaga, psakar, pslavice, psotirop, puntogil, pwright, rbryant, rnetuka, rrajasek, rstancel, rsvoboda, rsynek, rwagner, rzhang, sclewis, sdaley, sisharma, slinaber, ssaha, sstavrev, tcunning, tdecacqu, tkirby, trepel, twalsh, vbellur, vhalbert, vtunka, weli, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
See Also:	https://issues.redhat.com/browse/ENTESB-7945 https://issues.redhat.com/browse/ENTESB-8585
Whiteboard:
Fixed In Version:	springframework 5.0.5, springframework 4.3.15	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:19:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1564409
Bug Blocks:	1564412

Description Andrej Nemec 2018-04-06 08:02:43 UTC

Spring Framework provides client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

In order for the attacker to succeed, they would have to be able to guess the multipart boundary value chosen by server A for the multipart request to server B, which requires the attacker to also have control of the server or the ability to see the HTTP log of server A through a separate attack vector.

External References:

https://pivotal.io/security/cve-2018-1272

Comment 1 Andrej Nemec 2018-04-06 08:03:29 UTC

Created springframework tracking bugs for this issue:

Affects: fedora-all [bug 1564409]

Comment 3 errata-xmlrpc 2018-05-03 17:06:15 UTC

This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2018:1320 https://access.redhat.com/errata/RHSA-2018:1320

Comment 4 Happy Mia 2018-06-20 08:57:33 UTC

(In reply to Andrej Nemec from comment #0)
> Spring Framework provides client-side support for multipart requests. When
> Spring MVC or Spring WebFlux server application (server A) receives input
> from a remote client, and then uses that input to make a multipart request
> to another server (server B), it can be exposed to an attack, where an extra
> multipart is inserted in the content of the request from server A, causing
> server B to use the wrong value for a part it expects. This could to lead
> privilege escalation, for example, if the part content represents a username
> or user roles.
> 
> In order for the attacker to succeed, they would have to be able to guess
> the multipart boundary value chosen by server A for the multipart request to
> server B, which requires the attacker to also have control of the server or
> the ability to see the HTTP log of server A through a separate attack vector.
> 
> External References:
> 
> https://pivotal.io/security/cve-2018-1272

I want to reproduce the CVE-2018-1272 vulnerability in my project.
Please explain me how to attack this vulnerability. Thanks!

Comment 5 Andrej Nemec 2018-06-20 09:00:22 UTC

(In reply to Happy Mia from comment #4)
> (In reply to Andrej Nemec from comment #0)
> > Spring Framework provides client-side support for multipart requests. When
> > Spring MVC or Spring WebFlux server application (server A) receives input
> > from a remote client, and then uses that input to make a multipart request
> > to another server (server B), it can be exposed to an attack, where an extra
> > multipart is inserted in the content of the request from server A, causing
> > server B to use the wrong value for a part it expects. This could to lead
> > privilege escalation, for example, if the part content represents a username
> > or user roles.
> > 
> > In order for the attacker to succeed, they would have to be able to guess
> > the multipart boundary value chosen by server A for the multipart request to
> > server B, which requires the attacker to also have control of the server or
> > the ability to see the HTTP log of server A through a separate attack vector.
> > 
> > External References:
> > 
> > https://pivotal.io/security/cve-2018-1272
> 
> I want to reproduce the CVE-2018-1272 vulnerability in my project.
> Please explain me how to attack this vulnerability. Thanks!

Red Hat Product Security Team does not provide reproducers for security issues to external parties.

Comment 6 errata-xmlrpc 2018-09-11 07:54:36 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2018:2669 https://access.redhat.com/errata/RHSA-2018:2669