CVE-2017-4971: Spring Web Flow remote code execution vulnerability – Penetration Testing

Spring Web Flow builds on Spring MVC and allows implementing the “flows” of a web application. A flow encapsulates a sequence of steps that guide a user through the execution of some business task. It spans multiple HTTP requests, has state, deals with transactional data, is reusable, and may be dynamic and long-running in nature..

The sweet spot for Spring Web Flow are stateful web applications with controlled navigation such as checking in for a flight, applying for a loan, shopping cart checkout, or even adding a confirmation step to a form. What these scenarios have in common is one or more of the following traits:

There is a clear start and an end point.

The user must go through a set of screens in a specific order.

The changes are not finalized until the last step.

Once complete it shouldn’t be possible to repeat a transaction accidentally

Recently, Spring Web Flow released an update patch to fix a vulnerability that Spring Web Flow exists on data bindings (CVE-2017-4971). The vulnerability stems from the fact that the model’s data binding does not specify the specific properties of the relevant model, resulting in malicious expressions that can be submitted through the form and executed, resulting in remote code execution.

In the affected version, the vulnerability could be circumvented by changing the default configuration and improving the coding specification, and Spring Web Flow official has also released a patch to fix the vulnerability.

Affected Version

Spring Web Flow 2.4.0 – 2.4.4

How to fix

The official has released a new version, please affected 2.4.X users updated in time to upgrade to the latest 2.4.5 version to protect the vulnerability. The official also suggested that the user should change the default settings for data binding to ensure that the submitted form information meets the requirements to avoid similar malicious behavior.

Reference:

http://ift.tt/2sePUi4

The post CVE-2017-4971: Spring Web Flow remote code execution vulnerability appeared first on Penetration Testing. http://ift.tt/2ri7p4c http://ift.tt/2aM8QhC

Anúncios

Deixe um comentário

Preencha os seus dados abaixo ou clique em um ícone para log in:

Logotipo do WordPress.com

Você está comentando utilizando sua conta WordPress.com. Sair / Alterar )

Imagem do Twitter

Você está comentando utilizando sua conta Twitter. Sair / Alterar )

Foto do Facebook

Você está comentando utilizando sua conta Facebook. Sair / Alterar )

Foto do Google+

Você está comentando utilizando sua conta Google+. Sair / Alterar )

Conectando a %s