CVE-2020-5398 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
Attackers can trigger reflected file downloads via unsanitized Content-Disposition headers, potentially leading to code execution or security bypasses in Spring applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5398?
CVE-2020-5398 is a high-severity vulnerability in Netapp Data Availability Services, published on 16 Jan 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Which versions are affected by CVE-2020-5398?
12 open source packages ship an affected version, including org.springframework:spring-webflux and org.springframework:spring-webmvc. It affects 33 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework:spring-webflux Maven | From 5.0.0.RELEASE | 5.0.16.RELEASE |
org.springframework:spring-webflux Maven | From 5.0.0.RELEASE | 5.0.16.RELEASE |
org.springframework:spring-webflux Maven | From 5.1.0.RELEASE | 5.1.13.RELEASE |
org.springframework:spring-webflux Maven | From 5.1.0.RELEASE | 5.1.13.RELEASE |
org.springframework:spring-webflux Maven | From 5.2.0.RELEASE | 5.2.3.RELEASE |
org.springframework:spring-webflux Maven | From 5.2.0.RELEASE | 5.2.3.RELEASE |
6 more packages
org.springframework:spring-webmvc Maven | From 5.0.0.RELEASE | 5.0.16.RELEASE |
org.springframework:spring-webmvc Maven | From 5.0.0.RELEASE | 5.0.16.RELEASE |
org.springframework:spring-webmvc Maven | From 5.1.0.RELEASE | 5.1.13.RELEASE |
org.springframework:spring-webmvc Maven | From 5.1.0.RELEASE | 5.1.13.RELEASE |
org.springframework:spring-webmvc Maven | From 5.2.0.RELEASE | 5.2.3.RELEASE |
org.springframework:spring-webmvc Maven | From 5.2.0.RELEASE | 5.2.3.RELEASE |
Products include Netapp Data Availability Services, Netapp Snapcenter, Oracle Application Testing Suite, Oracle Communications Billing and Revenue Management Elastic Charging Engine, Oracle Communications Cloud Native Core Policy, Oracle Communications Diameter Signaling Router and 27 more.
How do I fix CVE-2020-5398?
Upgrade org.springframework:spring-webflux to a fixed version for your release line: 5.0.16.RELEASE, 5.1.13.RELEASE or 5.2.3.RELEASE.
Is CVE-2020-5398 being exploited?
There is no known exploitation of CVE-2020-5398 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-8wx2-9q48-vm9r, UBUNTU-CVE-2020-5398.