Spring Boot Actuator Authentication Bypass Vulnerability in CloudFoundry Endpoints

An authentication bypass vulnerability has been identified in Spring Boot applications that use Actuator, specifically when an application endpoint requiring authentication is placed under the CloudFoundry Actuator endpoint path. This vulnerability affects Spring Security versions 4.0.0 through 4.0.3, 3.5.0 through 3.5.11, 3.4.0 through 3.4.14, 3.3.0 through 3.3.17, and 2.7.0 through 2.7.31. Older, unsupported versions are also vulnerable.

Impact

Exploitation of this vulnerability allows for authentication bypass, potentially leading to unauthorized access to protected application endpoints.

Remediation

Users of affected Spring Boot versions should upgrade to 4.0.4, 3.5.12, 3.4.15 (Commercial), 3.3.18 (Commercial), or 2.7.32 (Commercial).