Executive brief
Spring Security, a widely used Java authentication and authorization library, contains a flaw that allows attackers to bypass authorization checks for static resources (such as images, CSS, and JavaScript files) in WebFlux applications. When Spring Security has been configured to protect static resources with authentication rules, this vulnerability allows unauthorized users to access those files directly. An attacker can exploit this without authentication to view sensitive resources or gain reconnaissance data about protected applications.
Technical details
This is an improper authorization vulnerability (CWE-285) in Spring Security's handling of static resources in reactive WebFlux applications. The root cause lies in how Spring Security validates authorization rules when serving static resources; under specific conditions, the authorization checks can be bypassed, allowing unauthenticated access to protected static content. The vulnerability requires that the application: (1) uses Spring WebFlux (not traditional Spring MVC), (2) enables Spring's static resource support, and (3) has non-permitAll authorization rules applied to static resources. The attack vector is network-based with no special privileges or user interaction required (CVSS AV:N/PR:N/UI:N). An attacker can make HTTP requests directly to static resources to bypass security controls and access confidential or integrity-sensitive content. Patches are available for all affected versions: 5.7.13, 5.8.15, 6.0.13, 6.1.11, 6.2.7, and 6.3.4.
Affected products
- VMware Spring Security 5.0.0 through 5.7.12, 5.8.0 through 5.8.14, 6.0.0 through 6.0.12, 6.1.0 through 6.1.10, 6.2.0 through 6.2.6, 6.3.0 through 6.3.3
Timeline
- 2024-10-28: disclosed
- 2024-10-28: patched: Patches released for versions 5.7.13, 5.8.15, 6.0.13, 6.1.11, 6.2.7, 6.3.4