Spring Security HTTP Header Injection Vulnerability

Bugtraq ID:	49535
Class:	Input Validation Error
CVE:	CVE-2011-2732
Remote:	Yes
Local:	No
Published:	Sep 09 2011 12:00AM
Updated:	Sep 09 2011 12:00AM
Credit:	David Mas
Vulnerable:
Not Vulnerable:

Spring Security HTTP Header Injection Vulnerability

Spring Security is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input.

By inserting arbitrary headers into an HTTP response, attackers may be able to launch various attacks, including cross-site request forgery, cross-site scripting, and HTTP-request smuggling.

The following versions are vulnerable:

Spring Security 2.0.0 through 2.0.6
Spring Security 3.0.0 through 3.0.5

Spring Security HTTP Header Injection Vulnerability

Attackers can exploit this issue through a browser.

The following example URI is available:

http://www.example.com//mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue

Spring Security HTTP Header Injection Vulnerability

Solution:
Updates are available. Please see the references for details.

Spring Security HTTP Header Injection Vulnerability

References:

• CVE-2011-2732: Spring Security header injection vulnerability (SpringSource)
  
• SpringSource Homepage (SpringSource)
  
• CVE-2011-2732: Spring Security header injection vulnerability (s2-security )