CVE-2016-9879
Vulnerability from cvelistv5
Published
2017-01-06 22:00
Modified
2024-08-06 03:07
Severity ?
Summary
An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.
References
security_alert@emc.comhttp://www.securityfocus.com/bid/95142
security_alert@emc.comhttps://access.redhat.com/errata/RHSA-2017:1832
security_alert@emc.comhttps://pivotal.io/security/cve-2016-9879Mailing List, Vendor Advisory
Impacted products
n/aPivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T03:07:30.183Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:1832",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1832"
          },
          {
            "name": "95142",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95142"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://pivotal.io/security/cve-2016-9879"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1"
            }
          ]
        }
      ],
      "datePublic": "2017-01-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded \"/\" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Encoded \"/\" in path variables",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "name": "RHSA-2017:1832",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1832"
        },
        {
          "name": "95142",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95142"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://pivotal.io/security/cve-2016-9879"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "ID": "CVE-2016-9879",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded \"/\" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Encoded \"/\" in path variables"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:1832",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1832"
            },
            {
              "name": "95142",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95142"
            },
            {
              "name": "https://pivotal.io/security/cve-2016-9879",
              "refsource": "CONFIRM",
              "url": "https://pivotal.io/security/cve-2016-9879"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2016-9879",
    "datePublished": "2017-01-06T22:00:00",
    "dateReserved": "2016-12-06T00:00:00",
    "dateUpdated": "2024-08-06T03:07:30.183Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2016-9879\",\"sourceIdentifier\":\"security_alert@emc.com\",\"published\":\"2017-01-06T22:59:00.360\",\"lastModified\":\"2021-06-08T18:22:35.140\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded \\\"/\\\" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.\"},{\"lang\":\"es\",\"value\":\"Se descubri\u00f3 un problema en Pivotal Spring Security en versiones anteriores a 3.2.10, 4.1.x en versiones anteriores a 4.1.4 y 4.2.x en versiones anteriores a 4.2.1. Spring Security no considera par\u00e1metros de ruta URL cuando procesa restricciones de seguridad. A\u00f1adiendo un par\u00e1metro de ruta URL con con un \\\"/\\\" codificado a una petici\u00f3n, un atacante podr\u00eda ser capaz de eludir una restricci\u00f3n de seguridad. La causa principal de este problema es la falta de claridad en lo que se refiere al manejo de los par\u00e1metros de ruta en las Servlet Specification. Algunos contenedores Servlet incluyen par\u00e1metros de ruta en el valor devuelto para getPathInfo() y otros no. Spring Security utiliza el valor devuelto por getPathInfo() como parte del proceso de mapeo de peticiones a las restricciones de seguridad. La presencia inesperada de par\u00e1metros de ruta puede provocar que una restricci\u00f3n sea eludida. Los usuarios de Apache Tomcat (todas las versiones actuales) no est\u00e1n afectados por esta vulnerabilidad ya que Tomcat sigue la gu\u00eda proporcionada previamente por el grupo Servlet Expert y elimina los par\u00e1metros de ruta del valor devuelto por getContextPath(), getServletPath() y getPathInfo(). Usuarios de otros contenedores Servlet basados en Apache Tomcat podr\u00edan o no estar afectados dependiendo en si el manejo de los par\u00e1metros ha sido modificado. Se sabe que los Usuarios de IBM WebSphere Application Server 8.5.x est\u00e1n afectados. Usuarios de otros contenedores que implementan la especificaci\u00f3n Servlet podr\u00edan estar afectados.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-417\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFD426B7-885E-4C37-BA39-9877BB10685F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D32668E1-4839-474C-A97D-0A485BF3CE04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF0DADB2-8D42-4592-9433-2941E3D57F95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C97588A1-B874-41F2-871E-BD3D5057FAC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"00D3C6A3-4C51-4B2D-867A-A17B3AA39A19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2D23169-794F-42BB-A03A-D6451756445B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE534FC0-0589-4DDA-9B5F-9ECD0BE5BE5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9E33A46-01D0-4EA0-997F-6EAE4342C422\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9A0E838-84BB-4AE8-A673-CF6F18239B36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:3.2.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FAD6EE1-7E45-46A9-8B08-D08800E57980\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:4.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4DC74CB-3FE2-436C-8F3B-6C607B1C868F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:4.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"605DF913-AB13-40BC-B03B-8663BB96BD44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:4.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55C17CD1-C6BC-4625-839E-55EEAFEB06D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:4.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"614C55BF-7851-46B7-9D04-88D6354B48C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_security:4.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F34640C-5004-4E2D-8F2E-BC214F750688\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FD8F9CE-4E98-4187-B84A-429FA1C65E2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC1D7570-4AB4-44B0-B5ED-D103F0946F63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E709E36-B5D0-42E5-A305-AF385FD7F347\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49506702-1B31-4421-8DEE-5B789272EC6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"158777FD-83D1-44B9-83B4-A3F490CA76F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EDA2FE6B-6E42-4E97-B803-DAB671D30FF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72F5A562-5B2E-4BC7-8A81-EFE5ED265803\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"168E2F18-56C6-4789-BBAC-C99D4792046F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B53EBD40-8E1A-4516-927D-ED1CF212B211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A4E88BA-F637-4400-A64F-E6516AE8917C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32C745A6-FDE7-4236-BA1D-8BB22D184AA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C8EE753-8773-4DFF-90A7-35CE45C7EC30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4B0179F-C523-4835-BDF2-E7C2166B4B8A\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/95142\",\"source\":\"security_alert@emc.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:1832\",\"source\":\"security_alert@emc.com\"},{\"url\":\"https://pivotal.io/security/cve-2016-9879\",\"source\":\"security_alert@emc.com\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.