Security Bypass With Un-Prefixed Double Wildcard Pattern

Description

Using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Affected Spring Products and Versions

Spring Framework:

6.0.0 - 6.0.6
5.3.25 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Fix version	Availability
6.0.7	OSS
5.3.26	OSS

No further mitigation steps are necessary.

Credit

This vulnerability was discovered internally.

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C/CR:H/IR:H/AR:X/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:N&version=3.1

History

2023-03-20: Initial vulnerability report published.