Description

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-27T20:17:55.460Z",
  "pubdate": "2026-08-27T20:17:55.460Z",
  "executiveSummary": "This vulnerability involves an insecure default configuration in the jCIFS client utilized by Spring Integration, which permits a protocol downgrade to SMB1/CIFS.\nThe core issue stems from the client's failure to enforce a minimum SMB version, effectively allowing an attacker to force the use of legacy protocols.\nSMB1 is inherently insecure, lacking support for modern mandatory packet signing and encryption, thereby exposing communication channels to Man-in-the-Middle (MITM) attacks.\nSuccessful exploitation allows attackers to perform NTLM relay attacks and conduct content-tampering, potentially leading to unauthorized data modification or credential interception.\nAffected products include Spring Integration 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12.\nThe risk is significant as it undermines the integrity and confidentiality of SMB traffic, enabling adversaries positioned on the network path to intercept or manipulate data streams without requiring prior authentication or elevated privileges on the target server.",
  "technicalDetails": "The vulnerability resides within the jCIFS client integration in the Spring Integration framework, where the SMB protocol negotiation mechanism fails to mandate a secure minimum version by default. When the property 'smbMinVersion' is not explicitly configured by the developer, the client defaults to legacy negotiation patterns that include SMB1/CIFS.\nRoot Cause: The jCIFS implementation prioritizes backward compatibility over secure-by-default configurations. Because SMB1 lacks the security primitives of SMB 2.x and 3.x, such as mandatory packet signing and transport-layer encryption, it is susceptible to various interception techniques.\nAttack Flow: An attacker positioned as a Man-in-the-Middle (MITM) can intercept the initial SMB negotiation request sent by the Spring Integration application. By manipulating the dialect negotiation response, the attacker can force the client to fall back to the SMB1 protocol, even if the server is capable of higher, more secure versions.\nExploitation Method: Once the connection is downgraded to SMB1, the attacker can perform NTLM relay attacks. Since SMB1 does not enforce signing, the attacker can relay captured authentication challenges to another service or server, facilitating unauthorized access or privilege escalation within the network environment. Furthermore, the lack of encryption enables the attacker to perform content tampering, where the payload transmitted over the wire is read and modified in transit, compromising the integrity of data transfers between the Spring Integration application and the target SMB share.\nAffected Versions: The issue affects Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.\nPost-Exploitation Impact: Beyond immediate data interception, successful exploitation facilitates lateral movement within the network. By intercepting credentials or manipulating data streams, an attacker can compromise downstream systems or exfiltrate sensitive files accessed by the Spring Integration application. This vulnerability is particularly critical for applications that handle sensitive financial, administrative, or personal data via SMB file shares, as the attacker effectively bypasses standard session protection mechanisms.\nNetwork Exposure: This vulnerability is exploitable across any network segment where an attacker can influence the traffic flow between the application and the SMB server, such as local area networks or compromised segments with ARP poisoning or DNS spoofing capabilities."
}