CVE-2018-1272 spring: spring-framework: Multipart content pollution [fis-2.0]

Security Tracking Issue

Do not make this issue public.

This bug is subject to the Security Errata Policy.

The overall impact of the blocking security issue(s) is Low. Based on this impact, this bug must be resolved by 02-Oct-2019.

Please refer to the Security Errata Policy documentation for further details: https://docs.prodsec.redhat.com/policy-guide/#policy-errata

Flaw:

CVE-2018-1272 spring-framework: Multipart content pollution
https://bugzilla.redhat.com/show_bug.cgi?id=1564408

Spring Framework provides client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

In order for the attacker to succeed, they would have to be able to guess the multipart boundary value chosen by server A for the multipart request to server B, which requires the attacker to also have control of the server or the ability to see the HTTP log of server A through a separate attack vector.

External References:

https://pivotal.io/security/cve-2018-1272