CVE-2024-38821 (GCVE-0-2024-38821)

Vulnerability from cvelistv5 – Published: 2024-10-28 07:06 – Updated: 2025-01-24 20:03
VLAI?
Title
Authorization Bypass of Static Resources in WebFlux Applications
Summary
Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support
Severity ?
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Affected: 5.7.x , < 5.7.13 (Enterprise Support Only)
Affected: 5.8.x , < 5.8.15 (Enterprise Support Only)
Affected: 6.0.x , < 6.0.13 (Enterprise Support Only)
Affected: 6.1.x , < 6.1.11 (Enterprise Support Only)
Affected: 6.2.x , < 6.2.7 (OSS)
Affected: 6.3.x , < 6.3.4 (OSS)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:spring:webflux:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "webflux",
            "vendor": "spring",
            "versions": [
              {
                "lessThan": "5.7.13",
                "status": "affected",
                "version": "5.7.x",
                "versionType": "custom"
              },
              {
                "lessThan": "5.8.15",
                "status": "affected",
                "version": "5.8x",
                "versionType": "custom"
              },
              {
                "lessThan": "6.0.13",
                "status": "affected",
                "version": "6.0x",
                "versionType": "custom"
              },
              {
                "lessThan": "6.1.11",
                "status": "affected",
                "version": "6.1x",
                "versionType": "custom"
              },
              {
                "lessThan": "6.2.7",
                "status": "affected",
                "version": "6.2x",
                "versionType": "custom"
              },
              {
                "lessThan": "6.3.4",
                "status": "affected",
                "version": "6.3x",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-31T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-01T03:55:20.442Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-24T20:03:04.932Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250124-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "Spring Security",
          "product": "Spring",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "5.7.13",
              "status": "affected",
              "version": "5.7.x",
              "versionType": "Enterprise Support Only"
            },
            {
              "lessThan": "5.8.15",
              "status": "affected",
              "version": "5.8.x",
              "versionType": "Enterprise Support Only"
            },
            {
              "lessThan": "6.0.13",
              "status": "affected",
              "version": "6.0.x",
              "versionType": "Enterprise Support Only"
            },
            {
              "lessThan": "6.1.11",
              "status": "affected",
              "version": "6.1.x",
              "versionType": "Enterprise Support Only"
            },
            {
              "lessThan": "6.2.7",
              "status": "affected",
              "version": "6.2.x",
              "versionType": "OSS"
            },
            {
              "lessThan": "6.3.4",
              "status": "affected",
              "version": "6.3.x",
              "versionType": "OSS"
            }
          ]
        }
      ],
      "datePublic": "2024-10-22T05:34:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.\u003c/p\u003e\u003cp\u003eFor this to impact an application, all of the following must be true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eIt must be a WebFlux application\u003c/li\u003e\u003cli\u003eIt must be using Spring\u0027s static resources support\u003c/li\u003e\u003cli\u003eIt must have a non-permitAll authorization rule applied to the static resources support\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
            }
          ],
          "value": "Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.\n\nFor this to impact an application, all of the following must be true:\n\n  *  It must be a WebFlux application\n  *  It must be using Spring\u0027s static resources support\n  *  It must have a non-permitAll authorization rule applied to the static resources support"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-28T07:06:13.404Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2024-38821"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authorization Bypass of Static Resources in WebFlux Applications",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2024-38821",
    "datePublished": "2024-10-28T07:06:13.404Z",
    "dateReserved": "2024-06-19T22:32:06.583Z",
    "dateUpdated": "2025-01-24T20:03:04.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.\\n\\nFor this to impact an application, all of the following must be true:\\n\\n  *  It must be a WebFlux application\\n  *  It must be using Spring\u0027s static resources support\\n  *  It must have a non-permitAll authorization rule applied to the static resources support\"}, {\"lang\": \"es\", \"value\": \"Las aplicaciones WebFlux de Spring que tienen reglas de autorizaci\\u00f3n de Spring Security sobre recursos est\\u00e1ticos pueden omitirse en determinadas circunstancias. Para que esto afecte a una aplicaci\\u00f3n, deben cumplirse todas las condiciones siguientes: * Debe ser una aplicaci\\u00f3n WebFlux * Debe utilizar el soporte de recursos est\\u00e1ticos de Spring * Debe tener una regla de autorizaci\\u00f3n que no sea permitAll aplicada al soporte de recursos est\\u00e1ticos\"}]",
      "id": "CVE-2024-38821",
      "lastModified": "2024-10-28T13:58:09.230",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@vmware.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.2}]}",
      "published": "2024-10-28T07:15:07.633",
      "references": "[{\"url\": \"https://spring.io/security/cve-2024-38821\", \"source\": \"security@vmware.com\"}]",
      "sourceIdentifier": "security@vmware.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-770\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38821\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2024-10-28T07:15:07.633\",\"lastModified\":\"2025-01-24T20:15:32.427\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.\\n\\nFor this to impact an application, all of the following must be true:\\n\\n  *  It must be a WebFlux application\\n  *  It must be using Spring\u0027s static resources support\\n  *  It must have a non-permitAll authorization rule applied to the static resources support\"},{\"lang\":\"es\",\"value\":\"Las aplicaciones WebFlux de Spring que tienen reglas de autorizaci\u00f3n de Spring Security sobre recursos est\u00e1ticos pueden omitirse en determinadas circunstancias. Para que esto afecte a una aplicaci\u00f3n, deben cumplirse todas las condiciones siguientes: * Debe ser una aplicaci\u00f3n WebFlux * Debe utilizar el soporte de recursos est\u00e1ticos de Spring * Debe tener una regla de autorizaci\u00f3n que no sea permitAll aplicada al soporte de recursos est\u00e1ticos\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://spring.io/security/cve-2024-38821\",\"source\":\"security@vmware.com\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20250124-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38821\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-28T12:31:35.974420Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:spring:webflux:*:*:*:*:*:*:*:*\"], \"vendor\": \"spring\", \"product\": \"webflux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.7.x\", \"lessThan\": \"5.7.13\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.8x\", \"lessThan\": \"5.8.15\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.0x\", \"lessThan\": \"6.0.13\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.1x\", \"lessThan\": \"6.1.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.2x\", \"lessThan\": \"6.2.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.3x\", \"lessThan\": \"6.3.4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-28T12:37:58.707Z\"}}], \"cna\": {\"title\": \"Authorization Bypass of Static Resources in WebFlux Applications\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spring\", \"product\": \"Spring\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.7.x\", \"lessThan\": \"5.7.13\", \"versionType\": \"Enterprise Support Only\"}, {\"status\": \"affected\", \"version\": \"5.8.x\", \"lessThan\": \"5.8.15\", \"versionType\": \"Enterprise Support Only\"}, {\"status\": \"affected\", \"version\": \"6.0.x\", \"lessThan\": \"6.0.13\", \"versionType\": \"Enterprise Support Only\"}, {\"status\": \"affected\", \"version\": \"6.1.x\", \"lessThan\": \"6.1.11\", \"versionType\": \"Enterprise Support Only\"}, {\"status\": \"affected\", \"version\": \"6.2.x\", \"lessThan\": \"6.2.7\", \"versionType\": \"OSS\"}, {\"status\": \"affected\", \"version\": \"6.3.x\", \"lessThan\": \"6.3.4\", \"versionType\": \"OSS\"}], \"packageName\": \"Spring Security\", \"defaultStatus\": \"affected\"}], \"datePublic\": \"2024-10-22T05:34:00.000Z\", \"references\": [{\"url\": \"https://spring.io/security/cve-2024-38821\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.\\n\\nFor this to impact an application, all of the following must be true:\\n\\n  *  It must be a WebFlux application\\n  *  It must be using Spring\u0027s static resources support\\n  *  It must have a non-permitAll authorization rule applied to the static resources support\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSpring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.\u003c/p\u003e\u003cp\u003eFor this to impact an application, all of the following must be true:\u003c/p\u003e\u003cul\u003e\u003cli\u003eIt must be a WebFlux application\u003c/li\u003e\u003cli\u003eIt must be using Spring\u0027s static resources support\u003c/li\u003e\u003cli\u003eIt must have a non-permitAll authorization rule applied to the static resources support\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2024-10-28T07:06:13.404Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38821\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-01T03:55:20.442Z\", \"dateReserved\": \"2024-06-19T22:32:06.583Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2024-10-28T07:06:13.404Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.