Overview
Spring Framework is a comprehensive Java framework for building enterprise-level applications. It provides a powerful, flexible programming model that simplifies the development of web applications by allowing you to use Java as your primary language while offering a variety of tools to manage application configuration, data access, and security.
A Denial of Service (DoS) vulnerability (CVE-2022-22970) has been identified in the spring-beans package in Spring Framework which allows attackers to overwhelm servers with special crafted requests if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
Per OWASP: The denial of service (DoS) attacks aim to make a service “unavailable for the purpose it was designed.” In this case, the vulnerability allows excessively large or too many files to be involved thereby consuming most system resources and denying other users access.
This issue affects multiple versions of spring-beans from Spring Framework.
Details
Module Info
- Product: Spring Framework (spring-beans module)
- Affected packages: spring-beans
- Affected versions: <5.2.22, >=5.3.0 <5.3.20
- GitHub repository: https://github.com/spring-projects/spring-framework
- Published packages: https://central.sonatype.com/artifact/org.springframework/spring-beans
- Package manager: Maven
- Fixed in: NES for Spring Framework v4.3.32
Vulnerability Info
This Medium-severity vulnerability is found in the spring-beans.jar module of the Spring Framework.
When an application uses data binding to automatically map HTTP request parameters to fields in a model object, it may include fields of type MultipartFile or javax.servlet.Part to handle file uploads. The Spring Framework attempts to bind any matching request data to these fields. This becomes problematic when there is no limit on the size or number of files being bound, allowing attackers to submit excessively large or numerous files. This can overwhelm the server's memory, CPU, or disk storage, leading to a DoS condition.
Credits
- VMWare
Mitigation
Spring Framework 4 and 5 are no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Spring Framework.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
