CVE-2024-38821: Authorization Bypass of Static Resources in WebFlux Applications
Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.
For this to impact an application, all of the following must be true:
It must be a WebFlux application It must be using Spring's static resources support It must have a non-permitAll authorization rule applied to the static resources support
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38821?
CVE-2024-38821 is considered a medium severity vulnerability that can allow unauthorized access to static resources in Spring WebFlux applications.
How do I fix CVE-2024-38821?
To fix CVE-2024-38821, update the org.springframework.security:spring-security-web package to the latest version, specifically 6.3.4, 6.2.7, 6.1.11, 6.0.13, or 5.8.15.
Which versions of Spring Security are affected by CVE-2024-38821?
CVE-2024-38821 affects Spring Security versions from 5.7.0 to 5.8.14 and 6.0.0 to 6.3.3.
What conditions must be met for CVE-2024-38821 to be exploitable?
CVE-2024-38821 can be exploited if the application is a WebFlux application and is using Spring Security authorization rules on static resources.
Is CVE-2024-38821 related to Spring WebFlux?
Yes, CVE-2024-38821 specifically affects Spring WebFlux applications that have misconfigured Spring Security authorization rules.