CVE-2021-22113: Incorrect Authorization

May 10, 2021

Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security’s StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.

References

github.com/advisories/GHSA-vwpg-f6gw-rjvf
github.com/spring-cloud/spring-cloud-netflix/commit/8ecb3dca511c3ce0454e42ac31ee2331d7318c07
nvd.nist.gov/vuln/detail/CVE-2021-22113
tanzu.vmware.com/security/cve-2021-22113

Code Behaviors & Features

Detect and mitigate CVE-2021-22113 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →