PlaintextPasswordEncoder authenticates encoded passwords that are null

Vulnerability

Overview

CVE-2019-11272 affects Spring Security versions 4.2.x up to 4.2.12 and older unsupported versions. The vulnerability arises in the PlaintextPasswordEncoder, which stores passwords as plaintext. When a user's encoded password is stored as null, the authentication logic incorrectly accepts the literal string "null" as a valid password [1].

Exploitation

An attacker can exploit this flaw by simply providing the password "null" during authentication. No special privileges or network access beyond standard authentication endpoints are required. The vulnerability only applies to applications that use PlaintextPasswordEncoder and have users with null encoded passwords, which might occur due to misconfiguration or data corruption [1].

Impact

Successful exploitation allows an attacker to authenticate as any user whose stored password is null, gaining the same access privileges as that user. This can lead to unauthorized access to sensitive data or functions within the application [1].

Mitigation

Spring Security has addressed this flaw starting from version 4.2.13. Users should upgrade to a patched version or migrate from PlaintextPasswordEncoder to stronger password encoders (e.g., BCryptPasswordEncoder). For users still on unsupported versions, upgrading to a supported release is strongly recommended [1].