Spring Framework vulnerabilities

The Spring Framework versions from 4.0.0 to 4.0.4 and from 3.0.0 to 3.2.8, as well as possibly earlier unsupported versions, did not disable by default the resolution of URI references in a DTD declaration when processing user-provided XML documents. This enabled an XXE attack.

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Affects Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, and 5.3.0-5.3.49.

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Affects multiple versions of Spring Framework.

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.5.RELEASE-5.2.25.RELEASE.

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Affected versions: Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19.

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

Spring Framework versions 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14, and older unsupported versions are vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Affects Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Affected versions: Spring Framework 7.0.0 - 7.0.8, 6.2.0 - 6.2.19, 6.1.0 - 6.1.28, 6.0.0 - 6.0.30, 5.3.0 - 5.3.49, and 5.2.25.RELEASE and earlier.

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Affected versions: Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19.

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.0.RELEASE-5.2.25.RELEASE.

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. This affects a wide range of Spring Framework versions.

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Affects Spring Framework versions 7.0.0-7.0.8 and 6.2.0-6.2.19.

In an untrusted JMS environment, MappingJackson2MessageConverter and JacksonJsonMessageConverter in Spring Framework allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.

Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18 are vulnerable to Server-Side Request Forgery (SSRF) due to incorrect host parsing in UriComponentsBuilder. Applications relying on UriComponentsBuilder to parse and validate external URLs may be exposed to sending requests to internal resources.

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted contexts, which may allow an attacker to invoke unintended application logic.

Applications accepting user-supplied SpEL expressions may be vulnerable to DoS if evaluation triggers unbounded cache growth. Affects Spring Framework versions 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

Vulnerability in Spring Framework allows a DoS attack via specially crafted SpEL expressions, causing excessive resource consumption.

An integer overflow vulnerability exists in the Spring Expression Language (SpEL). An attacker can supply a specially crafted SpEL expression causing excessive resource consumption, leading to a Denial of Service (DoS).

Applications using AntPathMatcher in Spring Framework are vulnerable to ReDoS if an attacker can supply a pattern to match(), matchStart(), or extractUriTemplateVariables(). Affects Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Spring WebFlux applications using the Kotlin Router DSL may be vulnerable to a security bypass. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Spring MVC applications accepting user-supplied values in cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript injection, leading to XSS.

The JavaScriptUtils.javaScriptEscape() function in Spring Framework incorrectly escapes data, potentially leading to JavaScript code injection in the browser and an XSS vulnerability. Affected versions: 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Spring MVC or Spring WebFlux applications with a mapping for "/**" where the view name is not explicitly specified allow an attacker to craft a 302 redirect to an arbitrary external host via the redirect: prefix. Affects Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. The vulnerability affects Spring Framework versions 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Spring MVC and WebFlux applications are vulnerable to DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, 5.3.0-5.3.48.

A WebFlux application with a compromised subdomain (e.g., via XSS) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

WebSocket session IDs in the spring-websocket module are not cryptographically unpredictable, which may be exploitable in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0-7.0.7, 6.2.0-6.2.18, 6.1.0-6.1.27, and 5.3.0-5.3.48.

Spring Framework (versions 5.0.x prior to 5.0.7, 4.3.x prior to 4.3.18, and older unsupported versions) allows web applications to change the HTTP request method to any method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, an attacker can use this filter to escalate to an XST (Cross Site Tracing) attack.

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.