Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

A security bypass vulnerability has been identified in Spring WebFlux applications that use the Kotlin Router DSL. This issue affects Spring Framework versions 5.3.0 through 5.3.48, including versions no longer supported. The vulnerability arises when an application applies a filter that modifies the 'ServerRequest' before passing it to the next handler. In such cases, any security enhancements made to the request by the filter are ignored, and the original request is sent to the handler, undermining the intended security measures.

Impact

Exploitation of this vulnerability allows for security filters to be bypassed, potentially leading to unauthorized access or actions within the application.

Remediation

Users should upgrade to Spring Framework version 5.3.49. This version is available through the Spring Commercial subscription.