CVE-2024-22258: Improper Authentication in Spring Authorization Server

March 20, 2024 (updated December 5, 2024)

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.

Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.

An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

References

github.com/advisories/GHSA-x637-x8p3-5p22
github.com/spring-projects/spring-authorization-server/commit/a7035d22bd2de6c24e7125623d38fb83d8f659a9
nvd.nist.gov/vuln/detail/CVE-2024-22258
spring.io/security/cve-2024-22258

Code Behaviors & Features

Detect and mitigate CVE-2024-22258 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →