CVE-2024-22233: Spring Framework server Web DoS Vulnerability

Vulnerability

Overview

CVE-2024-22233 is a denial-of-service (DoS) vulnerability affecting Spring Framework versions 6.0.15 and 6.1.2. An attacker can trigger the condition by sending specially crafted HTTP requests to an application that uses Spring MVC and has Spring Security 6.1.6+ or 6.2.1+ on the classpath. The issue was identified and responsibly reported by a group of security researchers, including Aleksander Blomskøld and LiveOverflow, as noted in the Spring advisory [2].

Exploitation

Conditions

The vulnerability only manifests when all prerequisites are met: the application must use Spring MVC, and Spring Security version 6.1.6+ or 6.2.1+ must be present. In typical Spring Boot applications, this translates to having both the spring-boot-starter-web and spring-boot-starter-security dependencies. The attack vector is network-based, requires no authentication, and has low complexity, as reflected in the CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) [2].

Impact

A successful exploit results in a denial-of-service (DoS) condition, making the application unresponsive. There is no impact on confidentiality or integrity; the sole consequence is a temporary or prolonged service disruption. The advisory does not indicate any known exploitation in the wild at the time of publication, but the high availability impact warrants prompt patching.

Mitigation

The Spring team has released fixes: Spring Framework 6.0.15 users should upgrade to 6.0.16, and 6.1.2 users should upgrade to 6.1.3. No workarounds are described beyond applying the updated versions. Affected products are only the specified Framework versions; older releases are not impacted [2].