CVE-2021-22112 - Privilege escalation vulnerability

Abstract

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

The spring-security-web package is vulnerable to Improper Authorization. The saveContext() method in the HttpSessionSecurityContextRepository class and the contextChanged() method in the HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper class fail to store the HttpSession if the SecurityContext is altered more than once per request. An attacker can leverage this behavior to extend the scope of their existing privileges in order to access functionality that would otherwise be restricted.

The Oxygen Feedback product incorporates the Spring Framework as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2021-22112

Severity: High

CVSS Score: 8.8

The Spring Security 5.4.2 module (part of Spring Framework) third-party library used by Oxygen Feedback software products is an affected version mentioned in CVE-2021-22112 vulnerability description.

Starting with Oxygen Feedback 1.4.1, the Spring Security module was updated to version 5.4.5, which includes a fix for CVE-2021-22112.