CVE-2024-38821: Spring WebFlux Auth Bypass Vulnerability

CVE-2024-38821 Overview

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.

For this to impact an application, all of the following must be true:

• It must be a WebFlux application
• It must be using Spring's static resources support
• It must have a non-permitAll authorization rule applied to the static resources support

Critical Impact

This vulnerability allows bypassing authorization rules, potentially exposing sensitive static resources.

Affected Products

• Spring WebFlux applications
• Applications using Spring Security
• Applications with static resource constraints

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to Not Available
• Not Available - CVE CVE-2024-38821 assigned
• Not Available - Not Available releases security patch
• 2024-10-28 - CVE CVE-2024-38821 published to NVD
• 2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-38821

Vulnerability Analysis

This vulnerability occurs due to flaws in the handling of authorization rules for static resources in Spring WebFlux applications. The issue is triggered when specific conditions are met, allowing unauthorized access to protected resources.

Root Cause

The root cause lies in the improper application of security rules to static resources, particularly when specific authorization directives are not rigorously enforced.

Attack Vector

This vulnerability can be exploited remotely over a network by attackers who can craft requests that bypass specified security rules.

// Example exploitation code (sanitized)
String url = "/static/resource";
HttpHeaders headers = new HttpHeaders();
headers.setContentType(MediaType.APPLICATION_JSON);
HttpEntity<String> entity = new HttpEntity<>(headers);
ResponseEntity<String> response = restTemplate.exchange(url, HttpMethod.GET, entity, String.class);

Detection Methods for CVE-2024-38821

Indicators of Compromise

• Unauthorized access logs
• Unusual access patterns to static resources
• Security rule bypass events

Detection Strategies

Monitor application logs for unauthorized attempts to access static resources, and inspect security configurations for anomalies or misconfigurations.

Monitoring Recommendations

Utilize network monitoring and intrusion detection systems to detect abnormal access to sensitive resources. Implement detailed logging for all access requests to static content.

How to Mitigate CVE-2024-38821

Immediate Actions Required

• Review and update Spring Security configurations
• Enforce strict security rules for all static resources
• Conduct a thorough security audit of WebFlux applications

Patch Information

Ensure that all security patches related to Spring Security and WebFlux are applied promptly to address this vulnerability.

Workarounds

Modify security configurations to apply stringent access controls to critical static resources and verify correct configuration settings.

# Configuration example
security:
  resources:
    chain:
      - path: /**
        filters: "securityContextFilter"
        access: "hasRole('USER')"