CVE-2011-2732: Spring Security header injection vulnerability

[s2-security <s2-security () vmware com>]

CVE-2011-2732: Spring Security header injection vulnerability

Severity: Important

Versions Affected:
    2.0.0 to 2.0.6
    3.0.0 to 3.0.5
Earlier versions may also be affected

Description:
Spring Security allows the use of a parameter (named "spring-security-redirect" by default) to determine the location 
URL to which a user will be redirected after logging in. This will normally be submitted as part of the login request, 
so is deemed to be an acceptable use of remote supplied data. However, the functionality is in a base class which is 
also shared by logout code, so a logout URL could be maliciously constructed to contain a version of this parameter 
which contained CRLF characters in order to inject additional headers or split the response.

Example:
A logout link such as
/mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue
could be used to inject the header
NewHeader:InjectedValue
to the response

Mitigation:
Anyone using Spring Security's default logout handling support may be vulnerable, unless they are using a custom 
LogoutSuccessHandler which does not support this parameter.
All users may mitigate this issue by upgrading to 3.0.6
Users of 2.0.x may upgrade to 2.0.7

Fix:
Support for the use of the parameter has been disabled by default for logout handling in 3.0.6. A default response 
wrapper has also been used which will raise an exception if the value passed to HttpResponse.sendRedirect contains CR 
or LF characters.

Credit:
The issue was discovered by David Mas.

History:
2011-09-09: Original advisory

References:
[1] http://www.springsource.com/security/cve-2011-2732
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/