CVE-2022-22978 Authorization bypass in Spring Security
Attackers can bypass authorization checks in applications using Spring Security's RegexRequestMatcher with specific regex patterns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-22978?
CVE-2022-22978 is a critical authentication bypass vulnerability in Netapp Active Iq Unified Manager, published on 19 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Weakness: CWE-863
Which versions are affected by CVE-2022-22978?
12 open source packages ship an affected version, including org.springframework.security:spring-security-core and org.springframework.security:spring-security-web. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-core Maven | All versions | 5.4.11 |
org.springframework.security:spring-security-core Maven | All versions | 5.4.11 |
org.springframework.security:spring-security-core Maven | From 5.5.0 | 5.5.7 |
org.springframework.security:spring-security-core Maven | From 5.5.0 | 5.5.7 |
org.springframework.security:spring-security-core Maven | From 5.6.0 | 5.6.4 |
org.springframework.security:spring-security-core Maven | From 5.6.0 | 5.6.4 |
6 more packages
org.springframework.security:spring-security-web Maven | All versions | 5.4.11 |
org.springframework.security:spring-security-web Maven | All versions | 5.4.11 |
org.springframework.security:spring-security-web Maven | From 5.5.0 | 5.5.7 |
org.springframework.security:spring-security-web Maven | From 5.5.0 | 5.5.7 |
org.springframework.security:spring-security-web Maven | From 5.6.0 | 5.6.4 |
org.springframework.security:spring-security-web Maven | From 5.6.0 | 5.6.4 |
Products include Netapp Active Iq Unified Manager, Oracle Financial Services Crime and Compliance Management Studio, Vmware Spring Security.
How do I fix CVE-2022-22978?
Upgrade org.springframework.security:spring-security-core to a fixed version for your release line: 5.4.11, 5.5.7 or 5.6.4.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-22978 being exploited?
There is no known exploitation of CVE-2022-22978 in the wild and no public exploit code.
Public exploit code: 7 proofs of concept on GitHub.
Other vulnerabilities in Netapp Active Iq Unified Manager
Sources
Also known as GHSA-hh32-7344-cg2f, ROOT-APP-MAVEN-CVE-2022-22978, UBUNTU-CVE-2022-22978.