Vulnerability Name:

CVE-2016-9879 (CCN-120505)

Assigned:2016-12-28
Published:2016-12-28
Updated:2021-06-08
Summary:An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-417
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2016-9879

Source: BID
Type: UNKNOWN
95142

Source: CCN
Type: BID-95142
Pivotal Spring Security CVE-2016-9879 Security Bypass Vulnerability

Source: REDHAT
Type: UNKNOWN
RHSA-2017:1832

Source: XF
Type: UNKNOWN
pivotal-cve20169879-sec-bypass(120505)

Source: CCN
Type: Pivotal Web site
CVE-2016-9879 Encoded "/" in path variables

Source: CONFIRM
Type: Mailing List, Vendor Advisory
https://pivotal.io/security/cve-2016-9879

Vulnerable Configuration:Configuration 1:
  • cpe:/a:vmware:spring_security:4.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:4.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:4.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:4.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.7:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.8:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:4.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.9:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:spring_security:3.2.2:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:ibm:websphere_application_server:8.5.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.5.9:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:websphere_application_server:8.5.5.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    vmware spring security 4.2.0
    vmware spring security 4.1.1
    vmware spring security 4.1.0
    vmware spring security 4.1.2
    vmware spring security 3.2.7
    vmware spring security 3.2.8
    vmware spring security 4.1.3
    vmware spring security 3.2.9
    vmware spring security 3.2.6
    vmware spring security 3.2.1
    vmware spring security 3.2.3
    vmware spring security 3.2.0
    vmware spring security 3.2.5
    vmware spring security 3.2.4
    vmware spring security 3.2.2
    ibm websphere application server 8.5.5.6
    ibm websphere application server 8.5.0.2
    ibm websphere application server 8.5.5.8
    ibm websphere application server 8.5.5.1
    ibm websphere application server 8.5.5.0
    ibm websphere application server 8.5.5.5
    ibm websphere application server 8.5.5.9
    ibm websphere application server 8.5.5.4
    ibm websphere application server 8.5.0.1
    ibm websphere application server 8.5.5.7
    ibm websphere application server 8.5.0.0
    ibm websphere application server 8.5.5.3
    ibm websphere application server 8.5.5.2