Vulnerability-Lookup

CNVD-2024-09335

Vulnerability from cnvd - Published: 2024-02-21

Title

Spring Security存在访问控制错误漏洞

Description

Spring Security是一个能够为基于Spring的企业应用系统提供声明式的安全访问控制解决方案的安全框架。它提供了一组可以在Spring应用上下文中配置的Bean，充分利用了Spring IoC，DI（控制反转Inversion of Control ,DI:Dependency Injection 依赖注入）和AOP（面向切面编程）功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。 Spring Security存在访问控制错误漏洞，攻击者可利用该漏洞进行身份验证和授权绕过。

Severity

高

Patch Name

Spring Security存在访问控制错误漏洞的补丁

Patch Description

Formal description

目前官方已修复该漏洞，受影响用户可以升级更新到安全版本。官方下载链接： https://spring.io/projects/spring-security

Impacted products

Name
['Spring Spring Security >=6.1.0，<=6.1.6', 'Spring Spring Security >=6.2.0，<= 6.2.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-22234"
    }
  },
  "description": "Spring Security\u662f\u4e00\u4e2a\u80fd\u591f\u4e3a\u57fa\u4e8eSpring\u7684\u4f01\u4e1a\u5e94\u7528\u7cfb\u7edf\u63d0\u4f9b\u58f0\u660e\u5f0f\u7684\u5b89\u5168\u8bbf\u95ee\u63a7\u5236\u89e3\u51b3\u65b9\u6848\u7684\u5b89\u5168\u6846\u67b6\u3002\u5b83\u63d0\u4f9b\u4e86\u4e00\u7ec4\u53ef\u4ee5\u5728Spring\u5e94\u7528\u4e0a\u4e0b\u6587\u4e2d\u914d\u7f6e\u7684Bean\uff0c\u5145\u5206\u5229\u7528\u4e86Spring IoC\uff0cDI\uff08\u63a7\u5236\u53cd\u8f6cInversion of Control ,DI:Dependency Injection \u4f9d\u8d56\u6ce8\u5165\uff09\u548cAOP\uff08\u9762\u5411\u5207\u9762\u7f16\u7a0b\uff09\u529f\u80fd\uff0c\u4e3a\u5e94\u7528\u7cfb\u7edf\u63d0\u4f9b\u58f0\u660e\u5f0f\u7684\u5b89\u5168\u8bbf\u95ee\u63a7\u5236\u529f\u80fd\uff0c\u51cf\u5c11\u4e86\u4e3a\u4f01\u4e1a\u7cfb\u7edf\u5b89\u5168\u63a7\u5236\u7f16\u5199\u5927\u91cf\u91cd\u590d\u4ee3\u7801\u7684\u5de5\u4f5c\u3002\n\nSpring Security\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u548c\u6388\u6743\u7ed5\u8fc7\u3002",
  "formalWay": "\u76ee\u524d\u5b98\u65b9\u5df2\u4fee\u590d\u8be5\u6f0f\u6d1e\uff0c\u53d7\u5f71\u54cd\u7528\u6237\u53ef\u4ee5\u5347\u7ea7\u66f4\u65b0\u5230\u5b89\u5168\u7248\u672c\u3002\u5b98\u65b9\u4e0b\u8f7d\u94fe\u63a5\uff1a\r\nhttps://spring.io/projects/spring-security",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-09335",
  "openTime": "2024-02-21",
  "patchDescription": "Spring Security\u662f\u4e00\u4e2a\u80fd\u591f\u4e3a\u57fa\u4e8eSpring\u7684\u4f01\u4e1a\u5e94\u7528\u7cfb\u7edf\u63d0\u4f9b\u58f0\u660e\u5f0f\u7684\u5b89\u5168\u8bbf\u95ee\u63a7\u5236\u89e3\u51b3\u65b9\u6848\u7684\u5b89\u5168\u6846\u67b6\u3002\u5b83\u63d0\u4f9b\u4e86\u4e00\u7ec4\u53ef\u4ee5\u5728Spring\u5e94\u7528\u4e0a\u4e0b\u6587\u4e2d\u914d\u7f6e\u7684Bean\uff0c\u5145\u5206\u5229\u7528\u4e86Spring IoC\uff0cDI\uff08\u63a7\u5236\u53cd\u8f6cInversion of Control ,DI:Dependency Injection \u4f9d\u8d56\u6ce8\u5165\uff09\u548cAOP\uff08\u9762\u5411\u5207\u9762\u7f16\u7a0b\uff09\u529f\u80fd\uff0c\u4e3a\u5e94\u7528\u7cfb\u7edf\u63d0\u4f9b\u58f0\u660e\u5f0f\u7684\u5b89\u5168\u8bbf\u95ee\u63a7\u5236\u529f\u80fd\uff0c\u51cf\u5c11\u4e86\u4e3a\u4f01\u4e1a\u7cfb\u7edf\u5b89\u5168\u63a7\u5236\u7f16\u5199\u5927\u91cf\u91cd\u590d\u4ee3\u7801\u7684\u5de5\u4f5c\u3002\r\n\r\nSpring Security\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u548c\u6388\u6743\u7ed5\u8fc7\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Spring Security\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Spring Spring Security \u003e=6.1.0\uff0c\u003c=6.1.6",
      "Spring Spring Security \u003e=6.2.0\uff0c\u003c= 6.2.1"
    ]
  },
  "serverity": "\u9ad8",
  "submitTime": "2024-02-21",
  "title": "Spring Security\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2024-22234 (GCVE-0-2024-22234)

Vulnerability from cvelistv5 – Published: 2024-02-20 07:02 – Updated: 2025-02-13 17:33

Title

CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated

Summary

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly. * The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated * The application only uses isFullyAuthenticated via Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html or HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-21 19:46 UTC

CWE

CWE-284 - Improper Access Control

Assigner

vmware mitre root Scorecard

References

2 references

URL	Tags
https://spring.io/security/cve-2024-22234
https://security.netapp.com/advisory/ntap-2024031…

Impacted products

3 products

Vendor	Product	Version
Spring	Spring Security	Affected: 6.1.x , < 6.1.7 (6.1.7) Affected: 6.2.x , < 6.2.2 (6.2.2)
vmware	spring_security	Affected: 6.1.0 , < 6.1.7 (custom) cpe:2.3:a:vmware:spring_security:6.1.0:::::::*
vmware	spring_security	Affected: 6.2.0 , < 6.2.2 (custom) cpe:2.3:a:vmware:spring_security:6.2.0:::::::*

Date Public

2024-02-19 08:59

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:vmware:spring_security:6.1.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spring_security",
            "vendor": "vmware",
            "versions": [
              {
                "lessThan": "6.1.7",
                "status": "affected",
                "version": "6.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:vmware:spring_security:6.2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spring_security",
            "vendor": "vmware",
            "versions": [
              {
                "lessThan": "6.2.2",
                "status": "affected",
                "version": "6.2.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22234",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-21T19:46:52.509563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-26T17:21:05.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:33.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2024-22234"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240315-0003/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Security",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "6.1.7",
              "status": "affected",
              "version": "6.1.x",
              "versionType": "6.1.7"
            },
            {
              "lessThan": "6.2.2",
              "status": "affected",
              "version": "6.2.x",
              "versionType": "6.2.2"
            }
          ]
        }
      ],
      "datePublic": "2024-02-19T08:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u003c/code\u003e\u0026nbsp;method.\u003c/p\u003e\u003cp\u003eSpecifically, an application is vulnerable if:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application uses \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u003c/code\u003e\u0026nbsp;directly and a \u003ccode\u003enull\u003c/code\u003e\u0026nbsp;authentication parameter is passed to it resulting in an erroneous \u003ccode\u003etrue\u003c/code\u003e\u0026nbsp;return value.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eAn application is not vulnerable if any of the following is true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eThe application does not use \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u003c/code\u003e\u0026nbsp;directly.\u003c/li\u003e\u003cli\u003eThe application does not pass \u003ccode\u003enull\u003c/code\u003e\u0026nbsp;to \u003ccode\u003eAuthenticationTrustResolver.isFullyAuthenticated\u003c/code\u003e\u003c/li\u003e\u003cli\u003eThe application only uses \u003ccode\u003eisFullyAuthenticated\u003c/code\u003e\u0026nbsp;via \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html\"\u003eMethod Security\u003c/a\u003e\u0026nbsp;or \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html\"\u003eHTTP Request Security\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
            }
          ],
          "value": "In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u00a0method.\n\nSpecifically, an application is vulnerable if:\n\n  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u00a0directly and a null\u00a0authentication parameter is passed to it resulting in an erroneous true\u00a0return value.\n\n\nAn application is not vulnerable if any of the following is true:\n\n  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication)\u00a0directly.\n  *  The application does not pass null\u00a0to AuthenticationTrustResolver.isFullyAuthenticated\n  *  The application only uses isFullyAuthenticated\u00a0via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html \u00a0or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-15T11:06:18.496Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2024-22234"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240315-0003/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2024-22234",
    "datePublished": "2024-02-20T07:02:50.873Z",
    "dateReserved": "2024-01-08T16:40:16.141Z",
    "dateUpdated": "2025-02-13T17:33:37.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2024-09335

CVE-2024-22234 (GCVE-0-2024-22234)

Tags

Sightings

Nomenclature

Related by attack behaviour