CVE-2023-34036 Forwarded header exploit with Spring HATEOAS on WebFlux
Attackers can manipulate hypermedia links in Spring WebFlux applications by spoofing forwarded headers if trusted proxy validation is missing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34036?
CVE-2023-34036 is a medium-severity vulnerability in Spring HATEOAS, published on 17 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server.
For the application to be affected, it needs to satisfy the following requirements:
* It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses. * The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
Which versions are affected by CVE-2023-34036?
6 open source packages ship an affected version, including org.springframework.hateoas:spring-hateoas. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.hateoas:spring-hateoas Maven | All versions | 1.5.5 |
org.springframework.hateoas:spring-hateoas Maven | All versions | 1.5.5 |
org.springframework.hateoas:spring-hateoas Maven | From 2.0.0 | 2.0.5 |
org.springframework.hateoas:spring-hateoas Maven | From 2.0.0 | 2.0.5 |
org.springframework.hateoas:spring-hateoas Maven | From 2.1.0 | 2.1.1 |
org.springframework.hateoas:spring-hateoas Maven | From 2.1.0 | 2.1.1 |
Products include Vmware Spring Hateoas.
How do I fix CVE-2023-34036?
Upgrade org.springframework.hateoas:spring-hateoas to a fixed version for your release line: 1.5.5, 2.0.5 or 2.1.1.
Is CVE-2023-34036 being exploited?
There is no known exploitation of CVE-2023-34036 in the wild and no public exploit code.
Other vulnerabilities in Spring HATEOAS
Sources
Also known as GHSA-7m5c-fgwf-mwph.