cve/2023/CVE-2023-20860.md

CVE-2023-20860

Description

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

POC

Reference

No PoCs from references.

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/DrC0okie/HEIG_SLH_Labo1
• https://github.com/Dzmitry-Basiachenka/dist-foreign-aliakh
• https://github.com/Threekiii/Awesome-POC
• https://github.com/Threekiii/CVE
• https://github.com/ax1sX/SpringSecurity
• https://github.com/d4n-sec/d4n-sec.github.io
• https://github.com/fernandoreb/dependency-check-springboot
• https://github.com/hinat0y/Dataset1
• https://github.com/hinat0y/Dataset10
• https://github.com/hinat0y/Dataset11
• https://github.com/hinat0y/Dataset12
• https://github.com/hinat0y/Dataset2
• https://github.com/hinat0y/Dataset3
• https://github.com/hinat0y/Dataset4
• https://github.com/hinat0y/Dataset5
• https://github.com/hinat0y/Dataset6
• https://github.com/hinat0y/Dataset7
• https://github.com/hinat0y/Dataset8
• https://github.com/hinat0y/Dataset9
• https://github.com/limo520/CVE-2023-20860
• https://github.com/nomi-sec/PoC-in-GitHub