Bug 1131359 (CVE-2014-3527) - CVE-2014-3527 Spring Security CAS: Access control bypass via untrusted infomation usage in proxy ticket authentication
Summary: CVE-2014-3527 Spring Security CAS: Access control bypass via untrusted infoma...
Status: CLOSED NOTABUG
Alias: CVE-2014-3527
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20140724,repo...
Keywords: Security
Depends On: 1131361 1131362 1131363
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-08-19 06:00 UTC by Arun Babu Neelicattu
Modified: 2015-07-31 12:35 UTC (History)
18 users (show)

Fixed In Version: spring-security-cas 3.2.5.RELEASE, spring-security-cas 3.1.7.RELEASE
Doc Type: Bug Fix
Doc Text:
When using Spring Security's CAS Proxy ticket authentication, a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. A remote attacker could use this flaw to bypass any access control restrictions on which CAS services can authenticate to one another.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-08-20 04:24:31 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Bugzilla 1131350 None None None Never

Internal Trackers: 1131350

Description Arun Babu Neelicattu 2014-08-19 06:00:54 UTC
When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. A remote attacker could use this flaw to bypass any access control restrictions on which CAS services can authenticate to one another.

References:

http://www.gopivotal.com/security/cve-2014-3527
https://spring.io/blog/2014/08/15/cve-2014-3527-fixed-in-spring-security-3-2-5-and-3-1-7

Upstream Issue:

https://jira.spring.io/browse/SEC-2688

Comment 2 Arun Babu Neelicattu 2014-08-19 06:02:09 UTC
Created springframework-security tracking bugs for this issue:

Affects: fedora-all [bug 1131361]

Comment 5 Arun Babu Neelicattu 2014-08-19 06:07:49 UTC
Victims Record:

https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3527.yaml

Comment 6 Arun Babu Neelicattu 2014-08-20 04:24:31 UTC
Statement:

This issue did not affect the versions of spring-security-cas provided by jasperreports-server-pro as shipped with Red Hat Enterprise Virtualization Manager 3 as they did not include support for CAS Proxy Service URL configuration via request parameters.

Comment 7 Fedora Update System 2014-08-30 03:53:46 UTC
springframework-security-3.1.7-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2014-08-30 03:57:59 UTC
springframework-security-3.1.7-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.