CVE-2022-31692 Demo
Overview
A simple Spring Boot application demonstrating configuration that is vulnerable to CVE-2022-31692.
This vulnerability may attract attention due to its severity - it has a CVSS 3.x base score of 9.8 as it allows authentication bypass. The purpose of this project is to demonstrate the conditions described in the advisory, which lead to the vulnerability being applicable.
- The application expects that Spring Security applies security to forward and include dispatcher types.
- The application uses the
AuthorizationFilter
either manually or via theauthorizeHttpRequests()
method. - The application configures the
FilterChainProxy
to apply to forward and/or include requests (e.g.spring.security.filter.dispatcher-types = request, error, async, forward, include
). - The application may forward or include the request to a higher privilege-secured endpoint.
- The application configures Spring Security to apply to every dispatcher type via
authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)
For reference, I'm pretty sure this is the commit that addresses the vulnerability.
Demonstration
The application has three URLs:
/
The index page/admin
An admin page, which requires the user to provide Basic auth (creds "user"/"pass") and be assigned the ROLE_ADMIN role/forward
A server-side forward to the admin page
Access controls are specified via authorizeHttpRequests() in the SecurityConfig class.
.authorizeHttpRequests((authz) -> authz
.antMatchers("/").permitAll()
.antMatchers("/forward").permitAll()
.antMatchers("/admin").hasAuthority("ROLE_ADMIN")
.shouldFilterAllDispatcherTypes(true)
)
Expected behaviours
-
User accesses
/
and is not authenticated (thanks topermitAll()
) -
User accesses
/admin
. They don't provide authentication, and the request is rejected (401 Not authorized). -
User accesses
/admin
. They provide valid authentication, but the request is still rejected (403 Unauthorised) because they do not have the required role.hasAuthority("ROLE_ADMIN")
. -
User accesses
/forward
. Their requests passes through the security filter chain for GET /forward, which passes as valid (thanks topermitAll()
). The controller processes the request, and returnsforward:/admin
to the Dispatcher. As instructed by thespring.security.filter.dispatcher-types
and.shouldFilterAllDispatcherTypes(true)
settings, this is a FORWARD type, so should be passed through the filter chain again. This second pass through the filter results in the request being rejected (again, thanks tohasAuthority("ROLE_ADMIN")
).
Actual behaviour
User accesses /forward
, the request is passed through the filter chain once, and passes as valid. The forward is
processed, but instead of being passed through the chain again, it is just passed as valid, and the admin page is
returned.