header-logo
Suggest Exploit
vendor:
Spring Security
by:
7.5
CVSS
HIGH
Arbitrary HTTP Header Injection
CWE
Product Name: Spring Security
Affected Version From: 2.0.0
Affected Version To: 3.0.5
Patch Exists: YES
Related CWE:
CPE: a:spring_framework:spring_security
Metasploit:
Other Scripts:
Platforms Tested:

Arbitrary HTTP Header Injection in Spring Security

Attackers can inject arbitrary HTTP headers into an HTTP response, allowing them to launch various attacks such as cross-site request forgery, cross-site scripting, and HTTP-request smuggling.

Mitigation:

Implement input sanitization to properly sanitize user input in Spring Security.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/49535/info

Spring Security is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input.

By inserting arbitrary headers into an HTTP response, attackers may be able to launch various attacks, including cross-site request forgery, cross-site scripting, and HTTP-request smuggling.

The following versions are vulnerable:

Spring Security 2.0.0 through 2.0.6
Spring Security 3.0.0 through 3.0.5 

http://www.example.com//mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue

Navigation

Suggest Exploit

Services By CQR