CVE-2023-34034 - Vulnerability Details - OpenCVE

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Redhat	Jboss Fuse
Vmware	Spring Security

Configuration 1 [-]

OR	cpe:2.3:a:vmware:spring_security::::::::
	cpe:2.3:a:vmware:spring_security::::::::
	cpe:2.3:a:vmware:spring_security::::::::
	cpe:2.3:a:vmware:spring_security::::::::
	cpe:2.3:a:vmware:spring_security::::::::

Package	CPE	Advisory	Released Date
Red Hat Fuse 7.12.1
spring-security	cpe:/a:redhat:jboss_fuse:7	RHSA-2023:7247	2023-11-15T00:00:00Z

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2023-34034
https://security.netapp.com/advisory/ntap-20230814-0008/
https://spring.io/security/cve-2023-34034
https://www.cve.org/CVERecord?id=CVE-2023-34034

History

Mon, 28 Oct 2024 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-281
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2023-07-19T14:16:12.150Z

Updated: 2024-10-28T14:40:32.304Z

Reserved: 2023-05-25T17:21:56.199Z

Link: CVE-2023-34034

Vulnrichment

Updated: 2024-08-02T15:54:14.118Z

NVD

Status : Modified

Published: 2023-07-19T15:15:11.127

Modified: 2024-11-21T08:06:26.513

Link: CVE-2023-34034

Redhat

Severity : Important

Publid Date: 2023-07-19T00:00:00Z

Links: CVE-2023-34034 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-34034", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2023-05-25T17:21:56.199Z", "datePublished": "2023-07-19T14:16:12.150Z", "dateUpdated": "2024-10-28T14:40:32.304Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Spring Security", "vendor": "n/a", "versions": [{"lessThanOrEqual": "6.1.1", "status": "affected", "version": "Spring Security 6.1.0", "versionType": " "}, {"lessThanOrEqual": "6.0.4", "status": "affected", "version": "Spring Security 6.0.0 ", "versionType": " "}, {"lessThanOrEqual": "5.8.4", "status": "affected", "version": "Spring Security 5.8.0", "versionType": " "}, {"lessThanOrEqual": "5.7.9 ", "status": "affected", "version": "Spring Security 5.7.0 ", "versionType": " "}, {"lessThanOrEqual": "5.6.11", "status": "affected", "version": "Spring Security 5.6.0", "versionType": " "}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nUsing <code>\"**\"</code> as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.\n\n"}], "value": "Using \"**\" as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "potential for a security bypass", "lang": "en"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2023-07-19T14:16:12.150Z"}, "references": [{"url": "https://spring.io/security/cve-2023-34034"}, {"url": "https://security.netapp.com/advisory/ntap-20230814-0008/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:54:14.118Z"}, "title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2023-34034", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230814-0008/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-281", "lang": "en", "description": "CWE-281 Improper Preservation of Permissions"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-28T14:34:24.503021Z", "id": "CVE-2023-34034", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-28T14:40:32.304Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://spring.io/security/cve-2023-34034", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230814-0008/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:54:14.118Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-34034", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-28T14:34:24.503021Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-281", "description": "CWE-281 Improper Preservation of Permissions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-28T14:40:26.300Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "n/a", "product": "Spring Security", "versions": [{"status": "affected", "version": "Spring Security 6.1.0", "versionType": " ", "lessThanOrEqual": "6.1.1"}, {"status": "affected", "version": "Spring Security 6.0.0 ", "versionType": " ", "lessThanOrEqual": "6.0.4"}, {"status": "affected", "version": "Spring Security 5.8.0", "versionType": " ", "lessThanOrEqual": "5.8.4"}, {"status": "affected", "version": "Spring Security 5.7.0 ", "versionType": " ", "lessThanOrEqual": "5.7.9 "}, {"status": "affected", "version": "Spring Security 5.6.0", "versionType": " ", "lessThanOrEqual": "5.6.11"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2023-34034"}, {"url": "https://security.netapp.com/advisory/ntap-20230814-0008/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Using \"**\" as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.\n\n", "supportingMedia": [{"type": "text/html", "value": "\nUsing <code>\"**\"</code> as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "potential for a security bypass"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2023-07-19T14:16:12.150Z"}}}, "cveMetadata": {"cveId": "CVE-2023-34034", "state": "PUBLISHED", "dateUpdated": "2024-10-28T14:40:32.304Z", "dateReserved": "2023-05-25T17:21:56.199Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2023-07-19T14:16:12.150Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "3733907C-9C06-4C09-B1DA-084EEB1A74CD", "versionEndExcluding": "5.6.12", "versionStartIncluding": "5.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "6517F944-32C8-4C0A-A0C6-A101C1C9580A", "versionEndExcluding": "5.7.10", "versionStartIncluding": "5.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "C459A8B6-D5BD-4504-90DF-B539AFD4027E", "versionEndExcluding": "5.8.5", "versionStartIncluding": "5.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "9FC21F29-5A00-49C9-BDBD-F488E6E35AE3", "versionEndExcluding": "6.0.5", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "75F8781A-895F-4602-BA07-32BF2DF04CC9", "versionEndExcluding": "6.1.2", "versionStartIncluding": "6.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Using \"**\" as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.\n\n"}], "id": "CVE-2023-34034", "lastModified": "2024-11-21T08:06:26.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security@vmware.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-19T15:15:11.127", "references": [{"source": "security@vmware.com", "url": "https://security.netapp.com/advisory/ntap-20230814-0008/"}, {"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2023-34034"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20230814-0008/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2023-34034"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-281"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2023:7247", "cpe": "cpe:/a:redhat:jboss_fuse:7", "package": "spring-security", "product_name": "Red Hat Fuse 7.12.1", "release_date": "2023-11-15T00:00:00Z"}], "bugzilla": {"description": "spring-security-webflux: path wildcard leads to security bypass", "id": "2241271", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241271"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-145", "details": ["Using \"**\" as a pattern in Spring Security configuration \nfor WebFlux creates a mismatch in pattern matching between Spring \nSecurity and Spring WebFlux, and the potential for a security bypass.", "A flaw was found in Spring Security's WebFlux framework pattern matching, where it does not properly evaluate certain patterns. A server using path-based pattern matching in WebFlux could allow an attacker to bypass security settings for some request paths, potentially leading to information disclosure, access of functionality outside the user's permissions, or denial of service."], "mitigation": {"lang": "en:us", "value": "Users of path-based URL determination should ensure that all their patterns have a slash prepended.\nexample:\npathMatchers(\"home/**\") // vulnerable\npathMatchers(\"/home/**\") // not vulnerable"}, "name": "CVE-2023-34034", "package_state": [{"cpe": "cpe:/a:redhat:quarkus:2", "fix_state": "Not affected", "impact": "low", "package_name": "io.quarkus/quarkus-spring-security", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:camel_quarkus:2", "fix_state": "Not affected", "impact": "low", "package_name": "spring-security", "product_name": "Red Hat Integration Camel Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Out of support scope", "package_name": "spring-security", "product_name": "Red Hat JBoss Fuse 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Affected", "package_name": "spring-security", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "spring-security", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2023-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-34034\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-34034\nhttps://spring.io/security/cve-2023-34034"], "threat_severity": "Important", "upstream_fix": "spring-security 5.6.12, spring-security 5.7.10, spring-security 5.8.5, spring-security 6.0.5, spring-security 6.1.2"}