QID 377315

QID 377315: Spring Web Flow Data Binding Expression Vulnerability

Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e. set to "false") can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

Affected Versions:
Spring Web Flow 2.4.0 to 2.4.4 and older unsupported versions.

NOTE:
Spring Web Flow with JSF users are not impacted by this report.

QID Detection: (Authenticated) - Linux
Detection logic checks for the presence of vulnerable versions of spring-webflow jar files by using locate and ls -l /proc/*/fd commands.

QID Detection: (Authenticated) - Windows
On Windows system, the QID identifies vulnerable instance of Spring Webflow via WMI to check spring-webflow jar is included in the running processes via command-line.
QID Detection: (Authenticated) - MacOS
Detection logic checks the presence of vulnerable versions of spring-webflow jar files by using the locate command.

Successful exploitation of this vulnerability may affect the Integrity of the user.

CVSS V3 rated as Medium - 5.9 severity.

CVSS V2 rated as Medium - 4.3 severity.

Solution

The vendor has released an advisory to resolve these issues.

Customers are advised to visit Spring Web Flow for more information on this.
Workaround:
It is a good practice and recommended to always use explicit data binding declarations in view states in order to prevent form submissions from setting fields on the target object that should not be set.

Vendor References

Spring Web Flow Advisory - tanzu.vmware.com/security/cve-2017-4971

CVEs related to QID 377315

CVE-2017-4971 |

Software Advisories

Advisory ID	Software	Component	Link
Spring Web Flow Advisory			tanzu.vmware.com/security/cve-2017-4971

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].