Description

Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of certain client metadata fields when explicitly enabled.

An attacker possessing a valid Initial Access Token can dynamically register a malicious client with crafted metadata. Depending on the metadata provided and the Authorization Server's configuration, this can lead to Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).

Affected Spring Products and Versions

Spring Security:

• 7.0.0 - 7.0.4

Spring Authorization Server:

• 1.3.0 - 1.3.10
• 1.4.0 - 1.4.9
• 1.5.0 - 1.5.6

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Credit

The issue was identified and responsibly reported by Kelvin Mbogo (@addcontent).

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N&version=3.1