https://pivotal.io/security/cve-2020-5398

CVE-2020-5398: RFD Attack via “Content-Disposition” Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

CVE-2020-5398: RFD Attack via “Content-Disposition” Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
SeverityHighVendorSpring by PivotalVersions AffectedDescriptionIn Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header in the response
where the filename attribute is derived from user supplied input.

Specifically, an application is vulnerable when all of the following are true:

The header is prepared with org.springframework.http.ContentDisposition.
The filename is set via one of:

ContentDisposition.Builder#filename(String), or
ContentDisposition.Builder#filename(String, US_ASCII)




The value for the filename is derived from user supplied input.
The user supplied input is not sanitized by the application.
The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details).

An application is not vulnerable if any of the following is true:

The application does not set a “Content-Disposition” response header.
The header is not prepared with org.springframework.http.ContentDisposition.
The filename is set via one of:

ContentDisposition.Builder#filename(String, UTF_8), or
ContentDisposition.Builder#filename(String, ISO_8859_1)

The filename is not derived from user supplied input.
The filename is derived from user supplied input but sanitized by the application.
Affected Pivotal Products and VersionsSpring Framework5.2.0 to 5.2.25.1.0 to 5.1.125.0.0 to 5.0.15MitigationUsers of affected versions should apply the following mitigation. 5.2.x users should upgrade to 5.2.3. 5.1.x users should upgrade to 5.1.13. 5.0.x users should upgrade to 5.0.16. No other steps are necessary. Releases that have fixed this issue include:Spring Framework5.2.35.1.135.0.16CreditThis issue was identified and responsibly reported by Roman Shalymov from EPAM.Referenceshttps://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/reflected-file-download-a-new-web-attack-vector/https://github.com/spring-projects/spring-framework/issues/24220History2020-01-16: Initial vulnerability report published.

Spring框架是一个开放源代码的J2EE应用程序框架，由Rod Johnson发起，是针对bean的生命周期进行管理的轻量级容器（lightweight container）。

CVE-2020-5398

暂无

暂无