Log Forging in DispatcherServlet via requestURI [SPR-11591]

[spring-projects-issues]

Darius Bohni opened SPR-11591 and commented

There is an security issue on line 843/844. An attacker can manipulate the log via malicious request.

The method doService extracts the URI from the request and uses it unvalidated.

Source:

logger.debug("DispatcherServlet with name '" + getServletName() + "'" + resumed +
		" processing " + request.getMethod() + " request for [" + requestUri + "]");

An attacker can forge the log by sending a request containing %0D%0A

Like: /app/home%0D%0AFAKE

The log will looks like:

08:34:50.145 [http-bio-8080-exec-1] DEBUG o.s.web.servlet.DispatcherServlet - DispatcherServlet with name 'dispatcher' processing GET request for [/app/home
FAKE]

---

Affects: 3.2.8, 4.0.2

Referenced from: commits a2bdc28, 465ca24

Backported to: 3.2.9

[spring-projects-issues]

Juergen Hoeller commented

Good catch! For logging purposes in DispatcherServlet, we're using the encoded request URI as returned from HttpServletRequest.getRequestURI() now instead of UrlPathHelper's decoded one.

That said, since this is about debug logging only - which is never to be activated in a production system - the practical impact should be limited.

Juergen