CVE-2022-22978 Authorization Bypass in Spring Security

CVE-2022-22978 is a high-severity security vulnerability in VMware Spring Security that facilitates authorization bypass via improper input validation. When an application uses RegexRequestMatcher with regex patterns containing a dot (e.g., /admin/.*) for path matching, the framework fails to correctly sanitize URL-encoded newline (%0a) or carriage return (%0d) characters.

An attacker can append these encoded control characters to a request path to deceive the matcher, causing it to incorrectly permit access to sensitive administrative or protected resources. This vulnerability affects Spring Security versions prior to 5.5.7 and 5.6.4. The disclosure of functional proof-of-concept payloads on public platforms increases the risk of exploitation against internet-facing applications utilizing affected versions of the framework. Defenders must identify requests containing unauthorized URL-encoded control characters targeting protected URL patterns.

Impact

Successful exploitation of CVE-2022-22978 allows unauthenticated remote attackers to bypass security constraints, potentially leading to unauthorized access, data exfiltration, or administrative action against vulnerable web applications. Given the ubiquitous use of Spring Security in enterprise environments, widespread potential for impact exists across organizations hosting Java-based web services.

Recommendation

1. Patch all Spring Security instances immediately to versions 5.5.7, 5.6.4, or later to address the underlying validation flaw.
2. Implement strict input validation on all incoming HTTP requests to strip or reject URL-encoded control characters (0x0A and 0x0D) before they reach the security filter chain.
3. Deploy the Sigma detection rule below to identify exploitation attempts targeting restricted application paths.
4. Audit web server logs for HTTP requests containing percent-encoded newline or carriage return characters directed at protected URL patterns defined in RegexRequestMatcher.