CVE-2024-38821: Spring Security authorization bypass in WebFlux static resources

CVE-2024-38821 · Severity: critical · CVSS 9.1 · Published 2024-10-28

Spring Security, a widely used Java authentication and authorization library, contains a flaw that allows attackers to bypass authorization checks for static resources (such as images, CSS, and JavaScript files) in WebFlux applications. When Spring Security has been configured to protect static resources with authentication rules, this vulnerability allows unauthorized users to access those files directly. An attacker can exploit this without authentication to view sensitive resources or gain reconnaissance data about protected applications.

Technologies: org.springframework.security:spring-security-web (Maven), VMware Spring Security. Vendors: Maven, VMware.

Quick answers

Is CVE-2024-38821 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-38821 being exploited in the wild.
How severe is CVE-2024-38821?
Critical severity, with a CVSS score of 9.1, published 28 October 2024.
Which products and versions are affected?
org.springframework.security:spring-security-web (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.7.13; VMware Spring Security 5.0.0 through 5.7.12, 5.8.0 through 5.8.14, 6.0.0 through 6.0.12, 6.1.0 through 6.1.10, 6.2.0 through 6.2.6, 6.3.0 through 6.3.3.
Is there a fix for CVE-2024-38821?
Yes. org.springframework.security:spring-security-web (Maven): upgrade to 5.7.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-38821 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-38821?
Check whether you run org.springframework.security:spring-security-web (Maven) or VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.security:spring-security-web (Maven): upgrade to 5.7.13 or later
    # set org.springframework.security:spring-security-web to 5.7.13 in your pom.xml or build.gradle

Technical details

This is an improper authorization vulnerability (CWE-285) in Spring Security's handling of static resources in reactive WebFlux applications. The root cause lies in how Spring Security validates authorization rules when serving static resources; under specific conditions, the authorization checks can be bypassed, allowing unauthenticated access to protected static content. The vulnerability requires that the application: (1) uses Spring WebFlux (not traditional Spring MVC), (2) enables Spring's static resource support, and (3) has non-permitAll authorization rules applied to static resources. The attack vector is network-based with no special privileges or user interaction required (CVSS AV:N/PR:N/UI:N). An attacker can make HTTP requests directly to static resources to bypass security controls and access confidential or integrity-sensitive content. Patches are available for all affected versions: 5.7.13, 5.8.15, 6.0.13, 6.1.11, 6.2.7, and 6.3.4.

Affected products

  • VMware Spring Security 5.0.0 through 5.7.12, 5.8.0 through 5.8.14, 6.0.0 through 6.0.12, 6.1.0 through 6.1.10, 6.2.0 through 6.2.6, 6.3.0 through 6.3.3

Identifiers

  • CVE-2024-38821
  • GHSA-c4q5-6c82-3qpw

Timeline

  • 2024-10-28: disclosed
  • 2024-10-28: patched: Patches released for versions 5.7.13, 5.8.15, 6.0.13, 6.1.11, 6.2.7, 6.3.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.