CVE-2021-22112 Privilege escalation in spring security
Spring Security fails to save SecurityContext changes, allowing attackers to extend elevated privileges across the application if specific coding patterns are present.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22112?
CVE-2021-22112 is a high-severity vulnerability in Oracle Communications Element Manager, published on 23 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Which versions are affected by CVE-2021-22112?
12 open source packages ship an affected version, including org.springframework.security:spring-security-bom and org.springframework.security:spring-security-web. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-bom Maven | All versions | 5.2.9 |
org.springframework.security:spring-security-bom Maven | All versions | 5.2.9 |
org.springframework.security:spring-security-bom Maven | From 5.3.0 | 5.3.8 |
org.springframework.security:spring-security-bom Maven | From 5.3.0 | 5.3.8 |
org.springframework.security:spring-security-bom Maven | From 5.4.0 | 5.4.4 |
org.springframework.security:spring-security-bom Maven | From 5.4.0 | 5.4.4 |
6 more packages
org.springframework.security:spring-security-web Maven | All versions | 5.2.9 |
org.springframework.security:spring-security-web Maven | All versions | 5.2.9 |
org.springframework.security:spring-security-web Maven | From 5.3.0 | 5.3.8 |
org.springframework.security:spring-security-web Maven | From 5.3.0 | 5.3.8 |
org.springframework.security:spring-security-web Maven | From 5.4.0 | 5.4.4 |
org.springframework.security:spring-security-web Maven | From 5.4.0 | 5.4.4 |
Products include Oracle Communications Element Manager, Oracle Communications Interactive Session Recorder, Oracle Communications Unified Inventory Management, Oracle Hospitality Cruise Shipboard Property Management System, Oracle Insurance Policy Administration, Oracle Mysql Enterprise Monitor and 2 more.
How do I fix CVE-2021-22112?
Upgrade org.springframework.security:spring-security-bom to a fixed version for your release line: 5.2.9, 5.3.8 or 5.4.4.
Is CVE-2021-22112 being exploited?
There is no known exploitation of CVE-2021-22112 in the wild and no public exploit code.
Sources
Also known as GHSA-gq28-h5vg-8prx, ROOT-APP-MAVEN-CVE-2021-22112.