CVE-2020-5397 CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux
Attackers can bypass CSRF protections on non-authenticated Spring MVC or WebFlux endpoints using CORS preflight requests in Chrome with client certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-5397?
CVE-2020-5397 is a medium-severity vulnerability in Oracle Application Testing Suite, published on 17 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
Weakness: CWE-352
Which versions are affected by CVE-2020-5397?
4 open source packages ship an affected version, including org.springframework:spring-webflux and org.springframework:spring-webmvc. It affects 27 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework:spring-webflux Maven | From 5.2.0 | 5.2.3 |
org.springframework:spring-webflux Maven | From 5.2.0 | 5.2.3 |
org.springframework:spring-webmvc Maven | From 5.2.0 | 5.2.3 |
org.springframework:spring-webmvc Maven | From 5.2.0 | 5.2.3 |
Products include Oracle Application Testing Suite, Oracle Communications Brm - Elastic Charging Engine, Oracle Communications Diameter Signaling Router, Oracle Communications Element Manager, Oracle Communications Policy Management, Oracle Communications Session Route Manager and 21 more.
How do I fix CVE-2020-5397?
Upgrade org.springframework:spring-webflux to 5.2.3 or later.
Is CVE-2020-5397 being exploited?
There is no known exploitation of CVE-2020-5397 in the wild and no public exploit code.
Other vulnerabilities in Oracle Application Testing Suite
- CVE-2026-35290 Auth bypass in Oracle Application Testing Suite
- CVE-2026-46876 Auth bypass in Oracle Application Testing Suite
- CVE-2026-46924 Auth bypass in Oracle Application Testing Suite
- CVE-2019-2904 Auth bypass in Enterprise Repository
- CVE-2018-1275 Spring Framework has Improperly Implemented Security Check for Standard
Sources
Also known as GHSA-7pm4-g2qj-j85x, UBUNTU-CVE-2020-5397.