[Bug 1409838] New: CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1409838

Bug ID: 1409838
           Summary: CVE-2016-9879 Spring Security: Improper handling of
                    path parameters allows bypassing the security
                    constraint
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]

Spring Security does not consider URL path parameters when processing security
constraints. By adding a URL path parameter with an encoded "/" to a request,
an attacker may be able to bypass a security constraint. The root cause of this
issue is a lack of clarity regarding the handling of path parameters in the
Servlet Specification (see below). Some Servlet containers include path
parameters in the value returned for getPathInfo() and some do not. Spring
Security uses the value returned by getPathInfo() as part of the process of
mapping requests to security constraints. The unexpected presence of path
parameters can cause a constraint to be bypassed.

Users of Apache Tomcat (all current versions) are not affected by this
vulnerability since Tomcat follows the guidance previously provided by the
Servlet Expert group and strips path parameters from the value returned by
getContextPath(), getServletPath() and getPathInfo().

Users of other Servlet containers based on Apache Tomcat may or may not be
affected depending on whether or not the handling of path parameters has been
modified.

Users of IBM WebSphere Application Server 8.5.x are known to be affected.

Users of other containers that implement the Servlet specification may be
affected.

Mitigation:

Use a Servlet container known not to include path parameters in the return
values for getServletPath() and getPathInfo()

Upstream bug:

https://github.com/spring-projects/spring-security/issues/4169

External Reference:

https://pivotal.io/security/cve-2016-9879

[Bug 1409838] CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1409838

Adam Mariš  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1409840

--- Comment #1 from Adam Mariš  ---

Created springframework-security tracking bugs for this issue:

Affects: fedora-all [bug 1409840]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1409840
[Bug 1409840] CVE-2016-9879 springframework-security: Spring Security:
Improper handling of path parameters allows bypassing the security
constraint [fedora-all]

[Bug 1409838] CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1409838

Adam Mariš  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1409841

[Bug 1409838] CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1409838

Hooman Broujerdi  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
                   |1228,reported=20161229,sour |1228,reported=20161229,sour
                   |ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS:
                   |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U
                   |/C:N/I:H/A:N,cwe=CWE-20,fus |/C:N/I:H/A:N,cwe=CWE-20,ope
                   |e-6/spring-security-core=ne |nshift-enterprise-2/spring-
                   |w,openshift-enterprise-2/sp |security-core=new,rhev-m-3/
                   |ring-security-core=new,rhev |jasperreports-server-pro=ne
                   |-m-3/jasperreports-server-p |w,fedora-all/springframewor
                   |ro=new,fedora-all/springfra |k-security=affected
                   |mework-security=affected    |

[Bug 1409838] CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1409838

Hooman Broujerdi  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
                   |1228,reported=20161229,sour |1228,reported=20161229,sour
                   |ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS:
                   |3.0/AV:N/AC:L/PR:L/UI:N/S:U |3.0/AV:N/AC:L/PR:L/UI:N/S:U
                   |/C:N/I:H/A:N,cwe=CWE-20,ope |/C:N/I:H/A:N,cwe=CWE-20,ope
                   |nshift-enterprise-2/spring- |nshift-enterprise-2/spring-
                   |security-core=new,rhev-m-3/ |security-core=new,rhev-m-3/
                   |jasperreports-server-pro=ne |jasperreports-server-pro=ne
                   |w,fedora-all/springframewor |w,fedora-all/springframewor
                   |k-security=affected         |k-security=affected,fuse-6/
                   |                            |camel=affected

[Bug 1409838] CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1409838
Bug 1409838 depends on bug 1409840, which changed state.

Bug 1409840 Summary: CVE-2016-9879 springframework-security: Spring Security: Improper handling of path parameters allows bypassing the security constraint [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1409840

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 1409838] CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint

https://bugzilla.redhat.com/show_bug.cgi?id=1409838

Hooman Broujerdi  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Doc Text *updated* ---
It was found that Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint.

[Bug 1409838] CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint

https://bugzilla.redhat.com/show_bug.cgi?id=1409838

--- Doc Text *updated* by Eric Christensen  ---
It was found that Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded / to a request an attacker may be able to bypass a security constraint.

[Bug 1409838] CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint

https://bugzilla.redhat.com/show_bug.cgi?id=1409838

--- Comment #4 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat JBoss Fuse

Via RHSA-2017:1832 https://access.redhat.com/errata/RHSA-2017:1832