All Vulnerability Reports

CVE-2018-1272: Multipart Content Pollution with Spring Framework


Severity

Low

Vendor

Spring by Pivotal

Description

Spring Framework versions 5.0 to 5.0.4, 4.3 to 4.3.14, and older unsupported versions provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

In order for the attacker to succeed, they would have to be able to guess the multipart boundary value chosen by server A for the multipart request to server B, which requires the attacker to also have control of the server or the ability to see the HTTP log of server A through a separate attack vector.

Affected Pivotal Products and Versions

Severity is low unless otherwise noted.

  • Spring Framework 5.0 to 5.0.4
  • Spring Framework 4.3 to 4.3.14
  • Older unsupported versions are also affected
Mitigation

Users of affected versions should apply the following mitigation:

  • 5.0.x users should upgrade to 5.0.5
  • 4.3.x users should upgrade to 4.3.15

There are no other mitigation steps necessary.

Credit

This issue was identified and responsibly reported by Philippe Arteau from GoSecure.

References
  • None
History

2018-04-05: Initial vulnerability report published