Pivotal Spring Security OAuth Open Redirector Attack Information Disclosure Vulnerability [CVE-2019-11269]

CVE Number – CVE-2019-11269

A vulnerability in Pivotal Spring Security OAuth could allow an unauthenticated, remote attacker to conduct an open redirect attack on a targeted system.

The vulnerability exists because the affected software does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by sending a request using the authorization code grant type to the targeted system and specifying a malicious redirection URI using the redirect_urlparameter. A successful exploit could cause the authorization server to redirect the resource owner user-agent to an attacker-controlled URI, providing the attacker with sensitive information, such the authorization code, which could be used to conduct further attacks. 

Pivotal Software has confirmed the vulnerability and released software updates.

Analysis

• To exploit this vulnerability, an attacker must send a request that submits malicious input to the targeted system, making exploitation more difficult in environments that restrict network access from untrusted sources.

Safeguards

• Administrators are advised to apply the appropriate updates.
  
  Administrators are advised to allow only trusted users to have network access.
  
  Administrators are advised to run both firewall and antivirus applications to minimize the potential of inbound and outbound threats.
  
  Administrators may consider using IP-based access control lists (ACLs) to allow only trusted systems to access the affected systems.
  
  Administrators can help protect affected systems from external attacks by using a solid firewall strategy.
  
  Administrators are advised to monitor affected systems.

Vendor Announcements

• Pivotal Software has released a security advisory at the following link: CVE-2019-11269: Open Redirector in spring-security-oauth2

Fixed Software

• Pivotal Software has released software updates at the following link: spring-security-oauth releases 2.0.18, 2.1.5, 2.2.5, and 2.3.6