Spring Framework provides client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles. In order for the attacker to succeed, they would have to be able to guess the multipart boundary value chosen by server A for the multipart request to server B, which requires the attacker to also have control of the server or the ability to see the HTTP log of server A through a separate attack vector. External References: https://pivotal.io/security/cve-2018-1272
Created springframework tracking bugs for this issue: Affects: fedora-all [bug 1564409]
This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2018:1320 https://access.redhat.com/errata/RHSA-2018:1320
(In reply to Andrej Nemec from comment #0) > Spring Framework provides client-side support for multipart requests. When > Spring MVC or Spring WebFlux server application (server A) receives input > from a remote client, and then uses that input to make a multipart request > to another server (server B), it can be exposed to an attack, where an extra > multipart is inserted in the content of the request from server A, causing > server B to use the wrong value for a part it expects. This could to lead > privilege escalation, for example, if the part content represents a username > or user roles. > > In order for the attacker to succeed, they would have to be able to guess > the multipart boundary value chosen by server A for the multipart request to > server B, which requires the attacker to also have control of the server or > the ability to see the HTTP log of server A through a separate attack vector. > > External References: > > https://pivotal.io/security/cve-2018-1272 I want to reproduce the CVE-2018-1272 vulnerability in my project. Please explain me how to attack this vulnerability. Thanks!
(In reply to Happy Mia from comment #4) > (In reply to Andrej Nemec from comment #0) > > Spring Framework provides client-side support for multipart requests. When > > Spring MVC or Spring WebFlux server application (server A) receives input > > from a remote client, and then uses that input to make a multipart request > > to another server (server B), it can be exposed to an attack, where an extra > > multipart is inserted in the content of the request from server A, causing > > server B to use the wrong value for a part it expects. This could to lead > > privilege escalation, for example, if the part content represents a username > > or user roles. > > > > In order for the attacker to succeed, they would have to be able to guess > > the multipart boundary value chosen by server A for the multipart request to > > server B, which requires the attacker to also have control of the server or > > the ability to see the HTTP log of server A through a separate attack vector. > > > > External References: > > > > https://pivotal.io/security/cve-2018-1272 > > I want to reproduce the CVE-2018-1272 vulnerability in my project. > Please explain me how to attack this vulnerability. Thanks! Red Hat Product Security Team does not provide reproducers for security issues to external parties.
This issue has been addressed in the following products: Red Hat JBoss Fuse Via RHSA-2018:2669 https://access.redhat.com/errata/RHSA-2018:2669