CVE-2023-34034 - Security Bypass Vulnerability in Spring Security with WebFlux using "**" Pattern

Recently, a security vulnerability was discovered in the Spring Security framework for WebFlux applications (CVE-2023-34034). The issue arises from the use of a "**" pattern in Spring Security configuration, which can lead to a mismatch in pattern matching between Spring Security and Spring WebFlux. As a result, an attacker could potentially bypass security mechanisms and gain unauthorized access to protected resources. This article will discuss the details of this vulnerability, provide code snippets demonstrating the issue, and offer possible solutions and recommendations.

Vulnerability Details

The vulnerability affects Spring Security configurations that apply the "" pattern in their WebFlux configurations. When the "" pattern is used, there is a mismatch in the way Spring Security and Spring WebFlux handle pattern matching for request URLs. This can lead to a gap in the security mechanisms, allowing malicious users to bypass security checks. The vulnerability affects Spring Security versions that are compatible with WebFlux, which include version 5.. and later.

The issue arises from the way Spring Security processes the "" pattern for URL patterns in a WebFlux configuration. Specifically, Spring Security handles the "" pattern as a wildcard that can match any sequence of characters in a URL, while Spring WebFlux interprets it with a narrower scope – only as a wildcard for the final path element in the URL. This discrepancy can lead to a security hole if a user is able to craft a request that can satisfy the Spring WebFlux pattern matching but not the Spring Security pattern matching mechanism.

Code Snippet

The following is an example of a Spring Security configuration with a potentially vulnerable "**" pattern:

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        http.authorizeExchange()
                .pathMatchers(HttpMethod.GET, "/api/**").authenticated()
                .anyExchange().permitAll()
                .and().build();
        return http.build();
    }

}

In this example, the configuration is set to require authentication for all HTTP GET requests to any URL under "/api/**". However, due to the mismatch in pattern matching behavior between Spring Security and Spring WebFlux, an attacker could potentially bypass this security restriction.

For demonstration purposes, consider the following WebFlux endpoint

@RestController
public class ApiController {

    @GetMapping("/api/resource")
    public Mono<String> getResource() {
        return Mono.just("Protected resource");
    }

}

This endpoint should be protected by the Spring Security configuration given above. However, an attacker can potentially bypass the authentication by crafting a malicious request, such as:

GET /api/resource%252f..%252fanything

This request will match the "/api/**" pattern in Spring WebFlux, while not being matched by the Spring Security pattern matcher. As a result, the attacker can gain unauthorized access to the protected resource.

Conclusions and Recommendations

To mitigate this vulnerability, it is recommended that developers avoid using the "**" pattern in their WebFlux security configurations. Instead, more specific and granular patterns should be used to ensure a consistent behavior between Spring Security and Spring WebFlux pattern matching.

For example, the following configuration explicitly covers the "/api/resource" endpoint, thus removing the security bypass vulnerability:

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        http.authorizeExchange()
                .pathPatterns(HttpMethod.GET, "/api/resource").authenticated()
                .anyExchange().permitAll()
                .and().build();
        return http.build();
    }

}

Additionally, developers should regularly monitor for updates and security patches related to Spring Security and WebFlux, and promptly apply any recommended fixes.

References

- Spring Security Project
- Spring WebFlux Project
- CVE-2023-34034 Mitre Page

Timeline

Published on: 07/19/2023 15:15:00 UTC
Last modified on: 08/14/2023 19:15:00 UTC