CVE-2023-34034 is a critical security vulnerability affecting certain versions of VMware's Spring Security, specifically in the Spring Security configuration for WebFlux. The issue arises from using "**" as a pattern, which creates a mismatch in pattern matching between Spring Security and Spring WebFlux, leading to the potential for a security bypass. This vulnerability impacts systems using specific versions of Spring Security, posing a significant risk to the affected systems.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, check if your system is running specific versions of VMware's Spring Security. The affected versions include 5.6.0 to 5.6.11, 5.7.0 to 5.7.9, 5.8.0 to 5.8.4, 6.0.0 to 6.0.4, and 6.1.0 to 6.1.1. If your system uses any of these versions, it may be at risk due to the security bypass issue caused by a mismatch in pattern matching between Spring Security and Spring WebFlux when using "**" as a pattern.

What should I do if I'm affected?

If you're affected by the vulnerability, follow these simple steps to address the issue. Upgrade to the fixed Spring Security versions: 6.1.2+, 6.0.5+, 5.8.5+, 5.7.10+, or 5.6.12+. Ensure you're using the required Spring Framework versions: 6.0.11+, 5.3.29+, or 5.2.25+. By upgrading to these versions, you'll mitigate the security bypass risk.

Is CVE-2023-34034 in CISA’s Known Exploited Vulnerabilities Catalog?

As of now, CVE-2023-34034 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This critical vulnerability affects certain versions of Spring Security and can lead to a security bypass. To address this issue, it's essential to upgrade to fixed Spring Security versions and ensure the required Spring Framework versions are in use. Stay vigilant and keep your systems updated to mitigate potential risks.

Weakness enumeration

The weakness enumeration for CVE-2023-34034 is listed as "Insufficient Information" with a CWE-ID of "NVD-CWE-noinfo" and sourced from NIST.

For more details

CVE-2023-34034 is a critical vulnerability with potential consequences such as sensitive information disclosure, data modification, or denial of service. Mitigation involves updating to fixed Spring Security versions. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• CVE-2023-34034 Spring Security Vulnerability in NetApp Products | NetApp Product Security

• CVE-2023-34034: WebFlux Security Bypass With Un-Prefixed Double Wildcard Pattern