Bug 1564408 (CVE-2018-1272) - CVE-2018-1272 spring-framework: Multipart content pollution
Summary: CVE-2018-1272 spring-framework: Multipart content pollution
Status: NEW
Alias: CVE-2018-1272
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20180405,reported=2...
Keywords: Security
Depends On: 1564409
Blocks: 1564412
TreeView+ depends on / blocked
 
Reported: 2018-04-06 08:02 UTC by Andrej Nemec
Modified: 2019-05-02 21:52 UTC (History)
86 users (show)

(edit)
Clone Of:
(edit)
Last Closed:


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:1320 None None None 2018-05-03 17:06 UTC
Red Hat Product Errata RHSA-2018:2669 None None None 2018-09-11 07:55 UTC

Description Andrej Nemec 2018-04-06 08:02:43 UTC
Spring Framework provides client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

In order for the attacker to succeed, they would have to be able to guess the multipart boundary value chosen by server A for the multipart request to server B, which requires the attacker to also have control of the server or the ability to see the HTTP log of server A through a separate attack vector.

External References:

https://pivotal.io/security/cve-2018-1272

Comment 1 Andrej Nemec 2018-04-06 08:03:29 UTC
Created springframework tracking bugs for this issue:

Affects: fedora-all [bug 1564409]

Comment 3 errata-xmlrpc 2018-05-03 17:06:15 UTC
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2018:1320 https://access.redhat.com/errata/RHSA-2018:1320

Comment 4 Happy Mia 2018-06-20 08:57:33 UTC
(In reply to Andrej Nemec from comment #0)
> Spring Framework provides client-side support for multipart requests. When
> Spring MVC or Spring WebFlux server application (server A) receives input
> from a remote client, and then uses that input to make a multipart request
> to another server (server B), it can be exposed to an attack, where an extra
> multipart is inserted in the content of the request from server A, causing
> server B to use the wrong value for a part it expects. This could to lead
> privilege escalation, for example, if the part content represents a username
> or user roles.
> 
> In order for the attacker to succeed, they would have to be able to guess
> the multipart boundary value chosen by server A for the multipart request to
> server B, which requires the attacker to also have control of the server or
> the ability to see the HTTP log of server A through a separate attack vector.
> 
> External References:
> 
> https://pivotal.io/security/cve-2018-1272

I want to reproduce the CVE-2018-1272 vulnerability in my project.
Please explain me how to attack this vulnerability. Thanks!

Comment 5 Andrej Nemec 2018-06-20 09:00:22 UTC
(In reply to Happy Mia from comment #4)
> (In reply to Andrej Nemec from comment #0)
> > Spring Framework provides client-side support for multipart requests. When
> > Spring MVC or Spring WebFlux server application (server A) receives input
> > from a remote client, and then uses that input to make a multipart request
> > to another server (server B), it can be exposed to an attack, where an extra
> > multipart is inserted in the content of the request from server A, causing
> > server B to use the wrong value for a part it expects. This could to lead
> > privilege escalation, for example, if the part content represents a username
> > or user roles.
> > 
> > In order for the attacker to succeed, they would have to be able to guess
> > the multipart boundary value chosen by server A for the multipart request to
> > server B, which requires the attacker to also have control of the server or
> > the ability to see the HTTP log of server A through a separate attack vector.
> > 
> > External References:
> > 
> > https://pivotal.io/security/cve-2018-1272
> 
> I want to reproduce the CVE-2018-1272 vulnerability in my project.
> Please explain me how to attack this vulnerability. Thanks!

Red Hat Product Security Team does not provide reproducers for security issues to external parties.

Comment 6 errata-xmlrpc 2018-09-11 07:54:36 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2018:2669 https://access.redhat.com/errata/RHSA-2018:2669


Note You need to log in before you can comment on or make changes to this bug.