CVE-2024-38807: Spring Boot Signature Forgery Vulnerability

A medium-severity vulnerability has been identified in Spring Boot: CVE-2024-38807. This vulnerability affects the way nested jars are loaded and signed, allowing malicious actors to forge signatures within Spring Boot-powered applications that use custom code for signature verification.

‍

CVE-2024-38807

This vulnerability impacts Spring Boot versions:

• 2.7.0 to 2.7.21
• 3.0.0 to 3.0.16
• 3.1.0 to 3.1.12
• 3.2.0 to 3.2.8
• 3.3.0 to 3.3.2

‍

Vulnerability Details

The issue stems from how Spring Boot's spring-boot-loader and spring-boot-loader-classic handle cryptographic signatures for nested jars. Applications that perform custom signature verification on nested jars may validate forged or invalid signatures, incorrectly attributing them as legitimate. This opens the door for potential exploitation, where a malicious jar could be validated and executed as trusted code.

This vulnerability affects applications that rely on cryptographic signatures to ensure the integrity and authenticity of loaded jars. If the application verifies signatures in nested jars, it may incorrectly load unsigned or invalid jars, potentially allowing malicious content to be executed without warning.

‍

Mitigation for CVE-2024-38807

Fixes for the CVE-2024-38807 vulnerability are now available. Affected users are encouraged to upgrade to the latest fixed versions:

• For Spring Boot 3.2.x, upgrade to 3.2.9 or newer.
• For Spring Boot 3.3.x, upgrade to 3.3.3 or newer.

Note: Spring Boot versions 2.7.x are no longer supported by the open-source community. For businesses and organizations still using these versions, HeroDevs offers Never-Ending Support (NES) for Spring Boot, which includes ongoing security patches and maintenance. Users on Spring Boot 2.7.x can update to NES for Spring 2.7.20 to secure their applications.

‍

Affected Packages

The following Spring Boot packages are affected by this vulnerability:

• spring-boot-loader (versions 2.7.0 to 2.7.21)
• spring-boot-loader-classic (versions 3.0.0 to 3.3.2)

For more technical details, refer to the official CVE-2024-38807 page.

‍

Why Upgrade with HeroDevs?

HeroDevs provides comprehensive support for Spring Boot, including long-term maintenance and security updates for end-of-life (EOL) software. If your business relies on older versions of Spring Boot that are no longer supported, HeroDevs ensures your systems remain secure, compliant, and compatible.

Key benefits of HeroDevs' Never-Ending Support (NES) for Spring Boot include:

• Security Updates: Immediate patches for vulnerabilities like CVE-2024-38807.
• Drop-in Compatibility: Easy, seamless updates without disrupting your existing Spring setup.
• Compliance Assurance: Ensuring your applications meet industry standards such as GDPR, HIPAA, and SOC 2.
• Expert Support: Backed by a team of experts deeply familiar with Spring Boot and legacy software support.

Conclusion

The CVE-2024-38807 vulnerability represents a significant security risk for Spring Boot applications that rely on custom signature verification of nested jars. Immediate action is necessary to upgrade to the latest supported versions to mitigate this risk. For users of older, unsupported versions, HeroDevs' Never-Ending Support for Spring Boot offers a robust, secure solution to keep your applications protected long-term.

Secure your applications today by upgrading to the latest version or leverage HeroDevs' support services to maintain security in your Spring Boot environments.

‍