Stored XSS in Spring Security OAuth2 Authorization Server

Executive Summary

This vulnerability affects Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4. When Dynamic Client Registration is enabled, the registration endpoint does not properly validate client metadata fields. An attacker with a valid Initial Access Token can register a malicious client with crafted metadata, potentially leading to XSS, privilege escalation, or SSRF depending on server use of the metadata.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Spring Security OAuth2 Authorization Server configurations for Dynamic Client Registration settings. Check if registration endpoints are exposed and validate client metadata handling. Review server logs for unusual client registrations or metadata values. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If you use Spring Security's OAuth2 Authorization Server with Dynamic Client Registration enabled, an attacker could exploit this to inject malicious scripts, gain elevated privileges, or make unauthorized server-side requests. This could compromise user data, system integrity, or allow further attacks depending on server configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or privilege escalation, which may violate GDPR's data protection requirements or HIPAA's security rules. Organizations must address this to maintain compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable Dynamic Client Registration if not required. If enabled, ensure strict validation of client metadata fields. Update to a patched version of Spring Security's OAuth2 Authorization Server module (7.0.5 or later).

Monitor for suspicious client registrations and review server configurations for potential XSS, privilege escalation, or SSRF risks.

Useful 0 Not Useful 0