Vulnerability DatabaseCVE-2024-22234

CVE-2024-22234:
Java vulnerability analysis and mitigation

Overview

A vulnerability (CVE-2024-22234) was discovered in Spring Security versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2. The vulnerability stems from broken access control when applications directly use the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. The issue occurs specifically when a null authentication parameter is passed to this method, resulting in an erroneous true return value (Spring Security, NVD).

Technical details

The vulnerability is related to the improper access control (CWE-284) in the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method implementation. When a null authentication parameter is passed to this method, it incorrectly returns true, potentially allowing unauthorized access. The vulnerability has received a CVSS v3.1 base score of 7.4 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (Security Online).

Impact

If exploited, this vulnerability could lead to unauthorized access within affected Java web applications, potentially resulting in data exposure of sensitive information, unrestricted resource access, and the ability to modify permissions or configurations within the system. The vulnerability could also lead to reputation damage for affected organizations (Security Online).

Mitigation and workarounds

Users of affected versions should upgrade to patched versions: 6.1.x users should upgrade to 6.1.7, and 6.2.x users should upgrade to 6.2.2. Organizations should also review their implementation to ensure they are not directly making isFullyAuthenticated() calls in their code and carefully handle potential null values (Spring Security).