CVE-2011-2732

Related Files

Spring Security Header Injection

Posted Sep 9, 2011

Authored by SpringSource Security Team, David Mas

Spring Security allows the use of a parameter (named "spring-security-redirect" by default) to determine the location URL to which a user will be redirected after logging in. This will normally be submitted as part of the login request, so is deemed to be an acceptable use of remote supplied data. However, the functionality is in a base class which is also shared by logout code, so a logout URL could be maliciously constructed to contain a version of this parameter which contained CRLF characters in order to inject additional headers or split the response. Versions 2.0.0 to 2.0.6 and 3.0.0 to 3.0.5 are affected.

tags | exploit, remote

advisories | CVE-2011-2732

SHA-256 | 190a53655a53fda33bb5be21ed5b61b82d8ef40a6afea588925d6719c66f2ba0

Download | Favorite | View