Cloudanix VulnDB

CVE-2024-22258

Medium · 6.1

CVSS

6.1

EPSS

0.5%

Published

Mar 20, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in certain authorization servers lets attackers bypass extra login protections used by some apps, potentially allowing them to access accounts without full verification.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Web Framework
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Enables a PKCE downgrade attack against confidential clients that use PKCE with the authorization code grant, allowing an attacker to bypass PKCE verification requirements and obtain authorization codes or tokens.

Why it matters to the business

May permit unauthorized access to protected resources and tokens in authorization flows, increasing risk of account compromise or data exposure; low immediate urgency given stable low EPSS, no KEV listing, and publication over two years ago.

How an attack unfolds

An attacker targets a confidential client using PKCE in the authorization code grant on a vulnerable Spring Authorization Server, manipulates the authorization request to downgrade or strip PKCE parameters, completes the flow, and obtains tokens without supplying a valid code verifier.

How to fix it

Upgrade affected Spring Authorization Server instances to versions beyond 1.2.2; for listed AlmaLinux packages apply nodejs-nodemon 1.18.3-1.module_el8.3.0+2023+d2377ea3 and nodejs-packaging 17-3.module_el8.4.0+2224+b07ac28e where applicable.

How to confirm the fix worked

Review client registration settings to confirm PKCE usage only on public clients or confirm upgrade to patched Spring Authorization Server releases; test authorization flows with and without PKCE to verify enforcement.

Typical attack path

  1. Identify an authorization endpoint accepting confidential clients configured with PKCE
  2. Intercept or craft an authorization request containing PKCE challenge parameters
  3. Perform downgrade manipulation to bypass PKCE checks
  4. Complete token request to obtain access or refresh tokens
  5. Use obtained tokens for unauthorized access

How to detect it

Examine authorization server logs for authorization code requests lacking expected PKCE parameters from confidential clients or showing mismatched code challenge methods; review token issuance events for anomalies in grant flows.

What your security team should do

  • Prioritize upgrade of Spring Authorization Server to a supported fixed release
  • Audit all confidential clients to ensure PKCE configuration aligns with guidance
  • Monitor for any new exploit maturity signals despite currently low EPSS

The record

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.springframework.security:spring-security-oauth2-authorization-server 0 1.1.6
Maven org.springframework.security:spring-security-oauth2-authorization-server 1.2.0 1.2.3
Ubuntu:16.04:LTS spring 0 No fix
Ubuntu:18.04:LTS spring 0 No fix
Ubuntu:20.04:LTS spring 0 No fix
Ubuntu:22.04:LTS spring 0 No fix
Ubuntu:24.04:LTS spring 0 No fix
Ubuntu:24.10 spring 0 No fix
Ubuntu:25.04 spring 0 No fix
Ubuntu:25.10 spring 0 No fix
Ubuntu:Pro:16.04:LTS spring 0 No fix
Ubuntu:Pro:18.04:LTS spring 0 No fix
Ubuntu:Pro:20.04:LTS spring 0 No fix
maven org.springframework.security/spring-security-oauth2-authorization-server 1.2.0 1.2.3

Related vulnerabilities