Description

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.

Specifically, an application is vulnerable when the following is true:

• The application evaluates user-supplied SpEL expressions.

Affected Spring Products and Versions

• Spring Framework
  • 5.3.0 to 5.3.38
  • Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Users of affected versions should apply the following mitigation: 5.3.x users should upgrade to 5.3.39+ or 6.0+. Evaluation of user-supplied SpEL expressions should be avoided when possible; otherwise, user-supplied SpEL expressions should be evaluated with a SimpleEvaluationContext in read-only mode. No other steps are necessary.

Releases that have fixed this issue include:

• Spring Framework
  • 5.3.39+
  • 6.0+

Credit

This issue was identified and responsibly reported by popko.

References

• https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
• https://cwe.mitre.org/data/definitions/770.html

History

• 2024-08-14: Initial vulnerability report published.