Description

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T06:17:19.867Z",
  "pubdate": "2026-08-27T06:17:19.867Z",
  "executiveSummary": "A vulnerability exists in the WebFlux framework when utilizing the Jetty 12 Core reactive adapter, specifically involving the improper serialization of HTTP response cookies.\nThe vulnerability occurs because the framework fails to propagate or include the 'SameSite' attribute during the cookie serialization process, resulting in cookies being generated without this critical security directive.\nAffected products include Spring Framework versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19.\nThe primary risk implication is increased susceptibility to Cross-Site Request Forgery (CSRF) attacks.\nBy omitting the 'SameSite' attribute, the browser defaults to less restrictive behavior, potentially allowing session cookies to be sent with cross-site requests.\nThis vulnerability is exploitable by remote, unauthenticated attackers who can lure a victim to a malicious site, where the browser will automatically include the vulnerable, non-restricted cookies in requests to the affected WebFlux application.\nSuccessful exploitation allows attackers to perform unauthorized actions on behalf of the authenticated user within the context of the vulnerable application.",
  "technicalDetails": "The root cause of this vulnerability lies in the integration logic between the Spring WebFlux reactive stack and the Jetty 12 Core reactive adapter. During the translation of server response headers—specifically the 'Set-Cookie' header—the serialization logic responsible for mapping cookie objects to wire-format strings fails to account for or incorrectly handles the 'SameSite' attribute configuration.\nIn modern web security architectures, the 'SameSite' attribute (set to 'Lax' or 'Strict') is a fundamental defense mechanism designed to mitigate CSRF by instructing the browser whether to send cookies with cross-site requests. By failing to include this attribute, the application defaults to 'SameSite=None' (in browsers that interpret the absence of the attribute as such or fallback to legacy behavior), rendering the session cookie accessible to unauthorized cross-site contexts.\nThe attack flow proceeds as follows: An authenticated user with a valid session cookie established on the target WebFlux application visits a third-party, attacker-controlled domain. The attacker's malicious site triggers an HTTP request (via an <img> tag, <form> submission, or fetch/XHR) to the vulnerable WebFlux application. Because the session cookie lacks the 'SameSite' attribute, the user's browser transmits the cookie along with the request. The WebFlux application, unable to distinguish the request origin due to the lack of 'SameSite' protection, processes the request as if it were a legitimate user-initiated action. This bypasses typical browser-level CSRF protections.\nThis behavior affects Spring Framework versions 7.0.0 - 7.0.8 and 6.2.0 - 6.2.19. The vulnerability is triggered entirely server-side; no specific client-side configuration or specialized headers are required from the attacker to initiate the exploitation beyond the existence of the vulnerability in the response serialization chain.\nThe exposure is network-wide, as any application utilizing the specified Jetty 12 reactive adapter is inherently susceptible to this cookie-handling defect. Post-exploitation, an attacker can leverage the user's session to execute state-changing operations (e.g., changing passwords, updating account details, or performing sensitive transactions) without user consent or interaction, significantly undermining the application's authentication security model."
}