Spring Security Authorization Server Default Consent Page XSS

Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in Spring Security Authorization Server's default consent page. It occurs because user-controlled values are rendered without proper HTML entity encoding, allowing attackers to inject malicious scripts through crafted OAuth2 authorization requests.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect your Spring Security Authorization Server for the default consent page (DefaultConsentPage). Check if user-controlled values in OAuth2 authorization requests are rendered without HTML entity encoding. Review server logs for unusual script injections or XSS attempts in consent page responses.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to execute arbitrary scripts in a victim's browser when they view the consent page. This may lead to session hijacking, data theft, or phishing attacks. Only systems using the default consent page are affected.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to fixed versions: 7.1.1 (OSS), 7.1.0.1 (Enterprise), 7.0.7 (OSS), or 7.0.6.1 (Enterprise). If custom consent pages are used, no further action is needed. Otherwise, apply the patch as soon as possible to prevent XSS exploitation.

Useful 0 Not Useful 0