Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of certain client metadata fields when explicitly enabled.
An attacker possessing a valid Initial Access Token can dynamically register a malicious client with crafted metadata. Depending on the metadata provided and the Authorization Server's configuration, this can lead to Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).
Spring Authorization Server :
No further mitigation steps are necessary.
The issue was identified and responsibly reported by Kelvin Mbogo ( @addcontent ).
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Check out all the upcoming events in the Spring community.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
