Bug 1591929 (CVE-2018-11039) - CVE-2018-11039 springframework: Cross Site Tracing (XST) if vulnerable to XSS
Summary: CVE-2018-11039 springframework: Cross Site Tracing (XST) if vulnerable to XSS
Status: CLOSED WONTFIX
Alias: CVE-2018-11039
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20180614,reported=2...
Keywords: Security
Depends On: 1591930 1648710 1648711 1648713 1648715 1648717
Blocks: 1639954
TreeView+ depends on / blocked
 
Reported: 2018-06-15 19:35 UTC by Laura Pardo
Modified: 2019-07-12 13:05 UTC (History)
57 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2019-07-12 13:05:37 UTC


Attachments (Terms of Use)

Description Laura Pardo 2018-06-15 19:35:14 UTC
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.


References:
https://pivotal.io/security/cve-2018-11039

Comment 1 Laura Pardo 2018-06-15 19:35:57 UTC
Created springframework tracking bugs for this issue:

Affects: fedora-all [bug 1591930]

Comment 5 Doran Moppert 2018-11-13 00:25:49 UTC
Mitigation:

According to the upstream advisory, this attack applies to applications that allow the application server to handle HTTP TRACE requests, and use the HiddenHttpMethodFilter.  Note that in the HiddenHttpMethodFilter is enabled by default in Spring Boot.

Comment 7 James Hebden 2018-11-14 00:35:05 UTC
Whilst the shipped versions of Open Dayight ship artifacts which fall within the affected versions ("older unsupported versions"), this flaw only has impact in the presence of an existing XSS flaw. Given there are currently no XSS flaws in the shipped versions, and the libraries themselves are not used in a vulnerable way, no package update to mitigate this flaw for Open Daylight is required.

Comment 9 Doran Moppert 2018-11-16 05:46:03 UTC
Statement:

From an OpenDaylight perspective, whilst the shipped versions of Open Dayight ship artifacts which fall within the affected versions ("older unsupported versions"), this flaw only has impact in the presence of an existing XSS flaw. Given there are currently no XSS flaws in the shipped versions, and the libraries themselves are not used in a vulnerable way, no package update to mitigate this flaw for Open Daylight is required.

The package rhevm-dependencies does not include the spring-webmvc component, where this vulnerability exists.

Comment 10 Joshua Padman 2019-05-15 22:55:37 UTC
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse Service Works 6
 * Red Hat JBoss BRMS 5
 * Red Hat JBoss Data Virtualization & Services 6
 * Red Hat JBoss SOA Platform 5

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 11 Joshua Padman 2019-06-07 03:45:51 UTC
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 12 Joshua Padman 2019-06-07 03:56:58 UTC
The vulnerability exist in org.springframework.web which is not a dependency of Fuse 7. Marked as not affected.

Comment 13 Product Security DevOps Team 2019-07-12 13:05:37 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-11039


Note You need to log in before you can comment on or make changes to this bug.