Loading vulnerability…
Cross-Site Scripting in Spring Web Flow JavaScript RemotingHandler
Spring Web Flow’s JavaScript RemotingHandler improperly renders error-response bodies as HTML even where the response content type is not text/html. If server error details reflect attacker-controlled input, that input can be interpreted by the browser and execute as script. Affected releases are Spring Web Flow 4.0.0, 3.0.0 through 3.0.1, and 2.5.0 through 2.5.1; older unsupported releases are also reported as affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause attacker-controlled script to execute in the context of a victim’s browser session. This can enable modification of application content or actions performed with the victim’s authenticated browser context. The reported CVSS v3.1 vector indicates network reachability, high attack complexity, low privileges, and required user interaction, with integrity impact and no reported confidentiality or availability impact.
If you can’t patch tonight, do this now.
No separate workaround is reported. Upgrade to the applicable fixed Spring Web Flow release. Until upgraded, reduce exposure by preventing attacker-controlled values from being reflected in error responses and ensuring errors returned to clients do not include unencoded request-derived details.
Patch, then assume compromise.
Upgrade Spring Web Flow to a fixed release appropriate to the deployed branch: 4.0.1 or later for 4.0.x deployments, or 3.0.2 or later for 3.0.x deployments. For the affected 2.5.x branch, obtain and deploy the vendor-supported fixed release, reported as 2.5.2 through enterprise support. Enterprise-supported fixes are also reported for certain individual affected releases.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.