CVE-2022-31690: 
Java vulnerability analysis and mitigation

CVE-2022-31690 affects Spring Security versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions. The vulnerability was discovered and disclosed on October 31, 2022, impacting applications using Spring Security's OAuth2 client functionality. This vulnerability allows privilege escalation under specific conditions when the application acts as a Login Client (Spring Security).

The vulnerability occurs when a malicious user can modify a request initiated by the Client to the Authorization Server, leading to privilege escalation when the Authorization Server responds with an empty scope list in the OAuth2 Access Token Response. This specifically affects applications that: act as a Login Client using http.oauth2Login(), implement authorization rules with authorities mapped from authorized scopes, and register an authorization server that responds with empty scopes list per RFC 6749, Section 5.1 (Spring Security). The vulnerability has been assigned a CVSS score of 8.1 (HIGH) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NetApp Advisory).

Successful exploitation of this vulnerability could lead to privilege escalation in affected applications. When exploited, users may gain unauthorized access to protected resources as the vulnerability allows for elevation of privileges when the authorization server returns an empty scope list. The impact is particularly significant for applications that rely on scope-based authorization rules (Spring Security).

The vulnerability requires specific conditions to be exploitable: the application must be configured as a Login Client, use scope-based authorization rules, and interact with an authorization server that can return empty scope lists. Applications that only act as Resource Servers or use non-scope-based authorization rules (e.g., hasAuthority("ROLE_USER")) are not affected by this vulnerability (Spring Security).

Users of affected versions should upgrade to Spring Security version 5.7.5 or 5.6.9, depending on their current version. For applications running on older, unsupported versions, upgrading to a supported branch is recommended. No alternative mitigation steps are available, making the upgrade the only effective solution (Spring Security).

The vulnerability was responsibly reported by Tobias Soloschenko (@klopfdreh) from Apache Software Foundation. Various organizations, including NetApp, have issued security advisories and implemented fixes in their products that utilize Spring Security (NetApp Advisory).