Spring Security - HTTP Header Injection

EDB-ID:

36130


Author:

David Mas

Type:

remote


Platform:

Multiple

Date:

2011-09-09


source: https://www.securityfocus.com/bid/49535/info

Spring Security is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sufficiently sanitize input.

By inserting arbitrary headers into an HTTP response, attackers may be able to launch various attacks, including cross-site request forgery, cross-site scripting, and HTTP-request smuggling.

The following versions are vulnerable:

Spring Security 2.0.0 through 2.0.6
Spring Security 3.0.0 through 3.0.5 

http://www.example.com//mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue