CVE-2022-22978: Spring Security Authorization Bypass

Summary

• Spring Security framework is a security framework that provides authentication and authorization functions in Spring-based applications.
• In Spring Security versions 5.5.6, 5.6.3 and earlier, when using RegexRequestMatcher, a function that grants permissions using regular expressions, an authorization bypass may occur if the request URL contains newline characters.
• An attacker can bypass access to the admin page (/admin) by using encoded newline characters such as %0a, %0d.

Environment Setup and Execution

• The test environment was prepared by running docker compose up -d.
• Run http://localhost:8080/admin to verify that access to the admin page is blocked.
• Run http://localhost:8080/admin/%0atest to access the admin page.

A vulnerable environment was configured.

Results

Access to the admin page is blocked.

%0d represents '\r' and %0a represents '\n', both newline characters. Sending requests using %0d or %0a allows bypassing access permissions.

Conclusion

If newline characters such as %0a or %0d are included in the URL, the RegexRequestMatcher processes the request path without handling newline characters, enabling permission bypass. Attackers can access the admin page via permission bypass and steal sensitive information there, so caution is required.

GitHub address: https://github.com/he-ewo/CVE-2022-22978.git