Spring gRPC AuthenticationException Message Reflection Vulnerability

A vulnerability exists in Spring gRPC versions 1.0.0 to 1.0.2, as well as older unsupported versions, where the raw message of server-side AuthenticationException is sent to unauthenticated remote callers in the gRPC status description. This exposure allows attackers to gain insights into authentication failures, potentially aiding in further attacks.

Impact

The vulnerability could lead to information disclosure regarding authentication failures, which may be leveraged for additional attacks.

Remediation

Users should upgrade to Spring gRPC version 1.0.3.