CVE-2018-1260

Vulnerability

Spring Security OAuth contains a remote code execution vulnerability in the authorization endpoint. Versions affected are 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15, and older unsupported versions [1]. A malicious user can craft an authorization request that causes remote code execution when the resource owner is forwarded to the approval endpoint.

Exploitation

An attacker crafts a malicious authorization request and sends it to the authorization endpoint. No authentication is required to send the request. When the resource owner (user) is subsequently forwarded to the approval endpoint, the crafted payload triggers remote code execution [1]. The exact mechanism is not detailed in public references.

Impact

Successful exploitation leads to remote code execution, allowing the attacker to execute arbitrary code on the server. This can result in complete compromise of confidentiality, integrity, and availability. The vulnerability has been rated as Critical/Important in Red Hat advisories [3][4].

Mitigation

The fix is to upgrade to secure versions: 2.3.3, 2.2.2, 2.1.2, or 2.0.15 [1]. The Spring Security OAuth project is no longer actively maintained and has been replaced by Spring Security's built-in OAuth2 support and Spring Authorization Server [2]. Users are advised to migrate to these replacements. Red Hat has released patches for Red Hat OpenShift Application Runtimes [4] and Red Hat FIS [3] that include the fix.