SiteMinder 12.8 SP7 or 12.8 SP8 admin UI with Spring Framework Vulnerability CVE-2024-22262 or CVE-2024-22259: Spring Framework URL Parsing with Host Validation (3rd report).

Products

• SITEMINDER

Issue/Introduction

Security team reported that SiteMinder 12.8 SP7 or 12.8 SP8 admin UI with Spring Framework Vulnerability CVE-2024-22262: Spring Framework URL Parsing with Host Validation (2nd report).

https://spring.io/security/cve-2024-22259 (2nd report)

https://spring.io/security/cve-2024-22262 (3rd report)

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22243, but with different input.

Environment

Release : 12.8.07,  12.8.08

Cause

3rd party library Vulnerability.

Resolution

To fix the reported vulnerabilities, spring framework binaries need to be upgraded to version 5.3.34.

Please follow the steps below to remove vulnerable spring framework jars(5.3.18) and upgrade to spring framework jars(5.3.34) in the Admin UI:

1. Stop the AdminUI server

2. Go to the folder : 
Linux OS Location: <install_location>/adminui/standalone/deployments/iam_siteminder.ear/library'  
Windows OS Location: <install_location>\adminui\standalone\deployments\iam_siteminder.ear\library

3. Take the backup of the below files and delete the files from this location
spring-web-5.3.18.jar
spring-core-5.3.18.jar
spring-tx-5.3.18.jar
spring-beans-5.3.18.jar
spring-aop-5.3.18.jar
spring-expression-5.3.18.jar
spring-context-5.3.18.jar

4. Go to the folder '<install location>/adminui/standalone/tmp/'

5. Remove the folder '/vfs/' if it exists

6. Download spring version 5.3.34 files from the below locations. Or download the "spring-5.3.34.zip" file attached at the bottom of this KB article.

https://mvnrepository.com/artifact/org.springframework/spring-beans/5.3.34
https://mvnrepository.com/artifact/org.springframework/spring-context/5.3.34
https://mvnrepository.com/artifact/org.springframework/spring-core/5.3.34
https://mvnrepository.com/artifact/org.springframework/spring-expression/5.3.34
https://mvnrepository.com/artifact/org.springframework/spring-tx/5.3.34
https://mvnrepository.com/artifact/org.springframework/spring-web/5.3.34
https://mvnrepository.com/artifact/org.springframework/spring-aop/5.3.34

spring-web-5.3.34.jar
spring-core-5.3.34.jar
spring-tx-5.3.34.jar
spring-beans-5.3.34.jar
spring-aop-5.3.34.jar
spring-expression-5.3.34.jar
spring-context-5.3.34.jar

7.Go to the folder : '<install_location>/adminui/standalone/deployments/iam_siteminder.ear/library' and copy the above spring framework jars(5.3.34) in this location

8.Start the Admin UI