Bug 1540030 (CVE-2018-1199) - CVE-2018-1199 spring-framework: Improper URL path validation allows for bypassing of security checks on static resources
Summary: CVE-2018-1199 spring-framework: Improper URL path validation allows for bypas...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1199
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1541996 (view as bug list)
Depends On: 1540032 1540033 1571049
Blocks: 1540036
TreeView+ depends on / blocked
 
Reported: 2018-01-30 06:32 UTC by Sam Fowler
Modified: 2021-10-21 19:54 UTC (History)
77 users (show)

Fixed In Version: springframework 5.0.3, springframework 4.3.14, springframework-security 5.0.1, springframework-security 4.2.4, springframework-security 4.1.5
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-21 19:54:02 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2405 0 None None None 2018-08-14 19:51:40 UTC

Description Sam Fowler 2018-01-30 06:32:18 UTC 
Spring Framework and Spring Security do not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint and access Spring MVC static resource URLs.

Affected versions include:
    * Spring Security 4.1.0 - 4.1.4, 4.2.0 - 4.2.3 and 5.0
    * Spring Framework 4.3.0 - 4.3.14, and 5.0.0 - 5.0.2

Older unmaintained versions of Spring Security and Spring Framework may also be affected.


External References:

https://pivotal.io/security/cve-2018-1199

Mitigation:

As a general precaution, users are encouraged to separate public and private resources. For example, separating static resources and mapping them to /resources/public/** and /resources/private/** is preferred to having one common root with mixed public and private resource content underneath.
Comment 1 Sam Fowler 2018-01-30 06:32:58 UTC 
Created springframework tracking bugs for this issue:

Affects: fedora-all [bug 1540033]


Created springframework-security tracking bugs for this issue:

Affects: fedora-all [bug 1540032]
Comment 2 Hooman Broujerdi 2018-02-13 04:32:34 UTC 
Jetty container in JBoss Fuse complies with servlet specification and does not return path parameters which is a root cause of this flaw, so JBoss Fuse is not affected.
Comment 3 Tomas Hoger 2018-02-26 08:37:26 UTC 
*** Bug 1541996 has been marked as a duplicate of this bug. ***
Comment 5 Summer Long 2018-03-08 22:03:20 UTC 
For RH OpenStack Platform: Although the spring code contains the flaw, OpenDaylight uses Tomcat which is not vulnerable. "Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath() and getPathInfo() [1]."
[1] https://www.securityfocus.com/archive/1/archive/1/514517/100/0/threaded <-- 2010.
catalina-7.0.27.1 used in ODL is from 2012 after the fixes. Should be ok.
Comment 11 Hooman Broujerdi 2018-06-14 01:34:17 UTC 
Fixed upstream in Spring-security 5.0.1, 4.2.4, 4.1.5 via following commits:
https://github.com/spring-projects/spring-security/commit/0eef5b4b425ab42b9fa0fde1a3f36a37b92558f2
https://github.com/spring-projects/spring-security/commit/cb8041ba67635edafcc934498ef82707157fd22a
https://github.com/spring-projects/spring-security/commit/65da28e4bf62f58fb130ba727cbbd621b44a36d1
Comment 12 Jason Shepherd 2018-06-14 04:32:16 UTC 
Spring Security is not used in Millicore component of RHMAP.
Comment 13 errata-xmlrpc 2018-08-14 19:51:12 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R7

Via RHSA-2018:2405 https://access.redhat.com/errata/RHSA-2018:2405
Note You need to log in before you can comment on or make changes to this bug.