CVE-2020-5408 Dictionary attack with Spring Security queryable text encryptor
An attacker with access to encrypted data can derive plaintext values via dictionary attack due to fixed initialization vectors in Spring Security's queryable text encryptor.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-5408?
CVE-2020-5408 is a medium-severity vulnerability in Spring Security, published on 14 May 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Which versions are affected by CVE-2020-5408?
10 open source packages ship an affected version, including org.springframework.security:spring-security-core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-core Maven | All versions | 4.2.16 |
org.springframework.security:spring-security-core Maven | All versions | 4.2.16 |
org.springframework.security:spring-security-core Maven | From 5.0.0 | 5.0.16 |
org.springframework.security:spring-security-core Maven | From 5.0.0 | 5.0.16 |
org.springframework.security:spring-security-core Maven | From 5.1.0 | 5.1.10 |
org.springframework.security:spring-security-core Maven | From 5.1.0 | 5.1.10 |
4 more packages
org.springframework.security:spring-security-core Maven | From 5.2.0 | 5.2.4 |
org.springframework.security:spring-security-core Maven | From 5.2.0 | 5.2.4 |
org.springframework.security:spring-security-core Maven | From 5.3.0 | 5.3.2 |
org.springframework.security:spring-security-core Maven | From 5.3.0 | 5.3.2 |
Products include Pivotal Software Spring Security, Vmware Spring Security.
How do I fix CVE-2020-5408?
Upgrade org.springframework.security:spring-security-core to a fixed version for your release line: 4.2.16, 5.0.16, 5.1.10 or 5.2.4.
Is CVE-2020-5408 being exploited?
There is no known exploitation of CVE-2020-5408 in the wild and no public exploit code.
Other vulnerabilities in Spring Security
Sources
Also known as GHSA-2ppp-9496-p23q.