HuntersHunters
Sign inStart free
Security context
Medium· 5.3GHSA-v596-fwhq-8x48 CVE-2018-1199CWE-20Published Oct 17, 2018

Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core

Research this vulnerability

Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.

Affected versions

4.2.0 → fixed in 4.2.45.0.0 → fixed in 5.0.14.3.0 → fixed in 4.3.145.0.0 → fixed in 5.0.34.1.0 → fixed in 4.1.5

Details

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

The fix

Allow interceptors to add existing header values

sdeleuze· Dec 8, 2017, 08:42 PM+33−1554662ebab
spring-web/src/main/java/org/springframework/web/client/RestTemplate.java+4 −1
@@ -21,6 +21,7 @@
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -909,7 +910,9 @@ public void doWithRequest(ClientHttpRequest httpRequest) throws IOException {
 				HttpHeaders httpHeaders = httpRequest.getHeaders();
 				HttpHeaders requestHeaders = this.requestEntity.getHeaders();
 				if (!requestHeaders.isEmpty()) {
-					httpHeaders.putAll(requestHeaders);
+					for (Map.Entry<String, List<String>> entry : requestHeaders.entrySet()) {
+						httpHeaders.put(entry.getKey(), new LinkedList<>(entry.getValue()));
+					}
 				}
 				if (httpHeaders.getContentLength() < 0) {
 					httpHeaders.setContentLength(0L);
spring-web/src/test/java/org/springframework/web/client/RestTemplateTests.java+29 −0
@@ -39,12 +39,15 @@
 import org.springframework.http.ResponseEntity;
 import org.springframework.http.client.ClientHttpRequest;
 import org.springframework.http.client.ClientHttpRequestFactory;
+import org.springframework.http.client.ClientHttpRequestInterceptor;
 import org.springframework.http.client.ClientHttpResponse;
 import org.springframework.http.converter.GenericHttpMessageConverter;
 import org.springframework.http.converter.HttpMessageConverter;
 import org.springframework.util.StreamUtils;
 import org.springframework.web.util.DefaultUriBuilderFactory;
  
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.collection.IsIterableContainingInOrder.contains;
 import static org.junit.Assert.*;
 import static org.mockito.BDDMockito.*;
 import static org.springframework.http.HttpMethod.POST;
@@ -822,4 +825,30 @@ public void exchangeParameterizedType() throws Exception {
 		verify(response).close();
 	}
  
+	@Test // SPR-15066
+	public void requestInterceptorCanAddExistingHeaderValue() throws Exception {
+		ClientHttpRequestInterceptor interceptor = (request, body, execution) -> {
+			request.getHeaders().add("MyHeader", "MyInterceptorValue");
+			return execution.execute(request, body);
+		};
+		template.setInterceptors(Collections.singletonList(interceptor));
+ 
+		given(requestFactory.createRequest(new URI("http://example.com"), HttpMethod.POST)).willReturn(request);
+		HttpHeaders requestHeaders = new HttpHeaders();
+		given(request.getHeaders()).willReturn(requestHeaders);
+		given(request.execute()).willReturn(response);
+		given(errorHandler.hasError(response)).willReturn(false);
+		HttpStatus status = HttpStatus.OK;
+		given(response.getStatusCode()).willReturn(status);
+		given(response.getStatusText()).willReturn(status.getReasonPhrase());
+ 
+		HttpHeaders entityHeaders = new HttpHeaders();
+		entityHeaders.add("MyHeader", "MyEntityValue");
+		HttpEntity<Void> entity = new HttpEntity<>(null, entityHeaders);
+		template.exchange("http://example.com", HttpMethod.POST, entity, Void.class);
+		assertThat(requestHeaders.get("MyHeader"), contains("MyEntityValue", "MyInterceptorValue"));
+ 
+		verify(response).close();
+	}
+ 
 }

Allow interceptors to add existing header values

sdeleuze· Dec 13, 2017, 09:08 AM+39−373a81f98d4
spring-web/src/main/java/org/springframework/web/client/RestTemplate.java+7 −2
@@ -922,6 +922,7 @@ public void doWithRequest(ClientHttpRequest httpRequest) throws IOException {
 				Class<?> requestBodyClass = requestBody.getClass();
 				Type requestBodyType = (this.requestEntity instanceof RequestEntity ?
 						((RequestEntity<?>)this.requestEntity).getType() : requestBodyClass);
+				HttpHeaders httpHeaders = httpRequest.getHeaders();
 				HttpHeaders requestHeaders = this.requestEntity.getHeaders();
 				MediaType requestContentType = requestHeaders.getContentType();
 				for (HttpMessageConverter<?> messageConverter : getMessageConverters()) {
@@ -930,7 +931,9 @@ public void doWithRequest(ClientHttpRequest httpRequest) throws IOException {
 								(GenericHttpMessageConverter<Object>) messageConverter;
 						if (genericConverter.canWrite(requestBodyType, requestBodyClass, requestContentType)) {
 							if (!requestHeaders.isEmpty()) {
-								httpRequest.getHeaders().putAll(requestHeaders);
+								for (Map.Entry<String, List<String>> entry : requestHeaders.entrySet()) {
+									httpHeaders.put(entry.getKey(), new LinkedList<>(entry.getValue()));
+								}
 							}
 							if (logger.isDebugEnabled()) {
 								if (requestContentType != null) {
@@ -948,7 +951,9 @@ public void doWithRequest(ClientHttpRequest httpRequest) throws IOException {
 					}
 					else if (messageConverter.canWrite(requestBodyClass, requestContentType)) {
 						if (!requestHeaders.isEmpty()) {
-							httpRequest.getHeaders().putAll(requestHeaders);
+							for (Map.Entry<String, List<String>> entry : requestHeaders.entrySet()) {
+								httpHeaders.put(entry.getKey(), new LinkedList<>(entry.getValue()));
+							}
 						}
 						if (logger.isDebugEnabled()) {
 							if (requestContentType != null) {
spring-web/src/test/java/org/springframework/web/client/RestTemplateTests.java+32 −1
@@ -826,7 +826,7 @@ public void exchangeParameterizedType() throws Exception {
 	}
  
 	@Test // SPR-15066
-	public void requestInterceptorCanAddExistingHeaderValue() throws Exception {
+	public void requestInterceptorCanAddExistingHeaderValueWithoutBody() throws Exception {
 		ClientHttpRequestInterceptor interceptor = (request, body, execution) -> {
 			request.getHeaders().add("MyHeader", "MyInterceptorValue");
 			return execution.execute(request, body);
@@ -851,4 +851,35 @@ public void requestInterceptorCanAddExistingHeaderValue() throws Exception {
 		verify(response).close();
 	}
  
+	@Test // SPR-15066
+	public void requestInterceptorCanAddExistingHeaderValueWithBody() throws Exception {
+		ClientHttpRequestInterceptor interceptor = (request, body, execution) -> {
+			request.getHeaders().add("MyHeader", "MyInterceptorValue");
+			return execution.execute(request, body);
+		};
+		template.setInterceptors(Collections.singletonList(interceptor));
+ 
+		MediaType contentType = MediaType.TEXT_PLAIN;
+		given(converter.canWrite(String.class, contentType)).willReturn(true);
+		given(requestFactory.createRequest(new URI("http://example.com"), HttpMethod.POST)).willReturn(request);
+		String helloWorld = "Hello World";
+		HttpHeaders requestHeaders = new HttpHeaders();
+		given(request.getHeaders()).willReturn(requestHeaders);
+		converter.write(helloWorld, contentType, request);
+		given(request.execute()).willReturn(response);
+		given(errorHandler.hasError(response)).willReturn(false);
+		HttpStatus status = HttpStatus.OK;
+		given(response.getStatusCode()).willReturn(status);
+		given(response.getStatusText()).willReturn(status.getReasonPhrase());
+ 
+		HttpHeaders entityHeaders = new HttpHeaders();
+		entityHeaders.setContentType(contentType);
+		entityHeaders.add("MyHeader", "MyEntityValue");
+		HttpEntity<String> entity = new HttpEntity<>(helloWorld, entityHeaders);
+		template.exchange("http://example.com", HttpMethod.POST, entity, Void.class);
+		assertThat(requestHeaders.get("MyHeader"), contains("MyEntityValue", "MyInterceptorValue"));
+ 
+		verify(response).close();
+	}
+ 
 }

Allow interceptors to add existing header values

sdeleuze· Dec 13, 2017, 06:02 AM+39−3e6e6b8f4ad
spring-web/src/main/java/org/springframework/web/client/RestTemplate.java+7 −2
@@ -852,6 +852,7 @@ public void doWithRequest(ClientHttpRequest httpRequest) throws IOException {
 				Class<?> requestBodyClass = requestBody.getClass();
 				Type requestBodyType = (this.requestEntity instanceof RequestEntity ?
 						((RequestEntity<?>)this.requestEntity).getType() : requestBodyClass);
+				HttpHeaders httpHeaders = httpRequest.getHeaders();
 				HttpHeaders requestHeaders = this.requestEntity.getHeaders();
 				MediaType requestContentType = requestHeaders.getContentType();
 				for (HttpMessageConverter<?> messageConverter : getMessageConverters()) {
@@ -859,7 +860,9 @@ public void doWithRequest(ClientHttpRequest httpRequest) throws IOException {
 						GenericHttpMessageConverter<Object> genericMessageConverter = (GenericHttpMessageConverter<Object>) messageConverter;
 						if (genericMessageConverter.canWrite(requestBodyType, requestBodyClass, requestContentType)) {
 							if (!requestHeaders.isEmpty()) {
-								httpRequest.getHeaders().putAll(requestHeaders);
+								for (Map.Entry<String, List<String>> entry : requestHeaders.entrySet()) {
+									httpHeaders.put(entry.getKey(), new LinkedList<String>(entry.getValue()));
+								}
 							}
 							if (logger.isDebugEnabled()) {
 								if (requestContentType != null) {
@@ -878,7 +881,9 @@ public void doWithRequest(ClientHttpRequest httpRequest) throws IOException {
 					}
 					else if (messageConverter.canWrite(requestBodyClass, requestContentType)) {
 						if (!requestHeaders.isEmpty()) {
-							httpRequest.getHeaders().putAll(requestHeaders);
+							for (Map.Entry<String, List<String>> entry : requestHeaders.entrySet()) {
+								httpHeaders.put(entry.getKey(), new LinkedList<String>(entry.getValue()));
+							}
 						}
 						if (logger.isDebugEnabled()) {
 							if (requestContentType != null) {
spring-web/src/test/java/org/springframework/web/client/RestTemplateTests.java+32 −1
@@ -836,7 +836,7 @@ public void exchangeParameterizedType() throws Exception {
 	}
  
 	@Test // SPR-15066
-	public void requestInterceptorCanAddExistingHeaderValue() throws Exception {
+	public void requestInterceptorCanAddExistingHeaderValueWithoutBody() throws Exception {
 		ClientHttpRequestInterceptor interceptor = (request, body, execution) -> {
 			request.getHeaders().add("MyHeader", "MyInterceptorValue");
 			return execution.execute(request, body);
@@ -861,4 +861,35 @@ public void requestInterceptorCanAddExistingHeaderValue() throws Exception {
 		verify(response).close();
 	}
  
+	@Test // SPR-15066
+	public void requestInterceptorCanAddExistingHeaderValueWithBody() throws Exception {
+		ClientHttpRequestInterceptor interceptor = (request, body, execution) -> {
+			request.getHeaders().add("MyHeader", "MyInterceptorValue");
+			return execution.execute(request, body);
+		};
+		template.setInterceptors(Collections.singletonList(interceptor));
+ 
+		MediaType contentType = MediaType.TEXT_PLAIN;
+		given(converter.canWrite(String.class, contentType)).willReturn(true);
+		given(requestFactory.createRequest(new URI("http://example.com"), HttpMethod.POST)).willReturn(request);
+		String helloWorld = "Hello World";
+		HttpHeaders requestHeaders = new HttpHeaders();
+		given(request.getHeaders()).willReturn(requestHeaders);
+		converter.write(helloWorld, contentType, request);
+		given(request.execute()).willReturn(response);
+		given(errorHandler.hasError(response)).willReturn(false);
+		HttpStatus status = HttpStatus.OK;
+		given(response.getStatusCode()).willReturn(status);
+		given(response.getStatusText()).willReturn(status.getReasonPhrase());
+ 
+		HttpHeaders entityHeaders = new HttpHeaders();
+		entityHeaders.setContentType(contentType);
+		entityHeaders.add("MyHeader", "MyEntityValue");
+		HttpEntity<String> entity = new HttpEntity<>(helloWorld, entityHeaders);
+		template.exchange("http://example.com", HttpMethod.POST, entity, Void.class);
+		assertThat(requestHeaders.get("MyHeader"), contains("MyEntityValue", "MyInterceptorValue"));
+ 
+		verify(response).close();
+	}
+ 
 }

References