Authorization Bypass During JWT Issuer Validation with spring-security
Spring by Pivotal · Spring Security
Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.What can follow
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 19 Dec 2018. No public exploit code or confirmed exploitation is recorded.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in spring-security-core over 2 years. The latest fix listed for spring-security-core is 5.3.2.
Fixes in spring-security-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 4.2.13CVE-2019-1127226 Jun 2019
- 5.0.0.M2CVE-2017-499527 Nov 2017
- 5.0.1CVE-2018-119916 Mar 2018
- 5.1.2CVE-2018-1580119 Dec 2018
- 5.1.5CVE-2019-37959 Apr 2019
- 5.3.2CVE-2020-540713 May 2020
- 5.3.2CVE-2020-540814 May 2020Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 1Lateral MovementTA0008
Detection
0 rules for this CVE · 4 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2018-15801 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Application Access TokenT1550.0014 general rules
- AWS Console GetSigninToken Potential Abusemediumtest
- AWS Suspicious SAML Activitymediumtest
- AWS STS AssumeRole Misuselowtest
- AWS STS GetSessionToken Misuselowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.springframework.security:spring-security-coreAffected: 5.1.0 up to 5.1.2Upgrade to 5.1.2 or later
- Mavenorg.springframework.security:spring-security-oauth2-joseAffected: 5.1.0 up to 5.1.2Upgrade to 5.1.2 or later