vulnerables/cve-2016-4977 repository overview

⁠Remote Code Execution (RCE) in Spring Security OAuth

When processing authorization requests using the whitelabel views, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.

⁠Vulnerable Versions

• 2.0.0 to 2.0.9
• 1.0.0 to 1.0.5

⁠Vulnerable code

This vulnerability was fixed in this commit⁠. With the description:

Prevent recursive placeholders in whitelabel views
This change prevents placeholders in model values from being
recursively replaced (which is a feature of the placeholder
utilities in Spring Core), so that user-provided data
(e.g. an invalid response_type or a leaky exception message)
cannot be used to inject SpEL into the view.

N.B. this only affects apps that are using the whitelabel views
for approval and error pages (i.e. probably nothing in
    production).

⁠Mitigation

Users of affected versions should apply the following mitigation

• Users of 1.0.x should not use whitelabel views for approval and error pages
• Users of 2.0.x should either not use whitelabel views for approval and error pages or upgrade to 2.0.10 or later

⁠Credits

This vulnerability was found by David Vieira-Kurz (@secalert) and reported by Oliver Schoenherr on behalf of Immobilien Scout GmbH.

⁠Disclaimer

This or previous program is for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies, especially the fact that me (opsxcq) is not liable for any damages caused by direct or indirect use of the information or functionality provided by these programs. The author or any Internet provider bears NO responsibility for content or misuse of these programs or any derivatives thereof. By using these programs you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of these programs is not opsxcq's responsibility.