Bug 2275257 (CVE-2024-22262)

Summary: CVE-2024-22262 springframework: URL Parsing with Host Validation
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: adupliak, anstephe, ataylor, avibelli, bgeorges, boliveir, chazlett, chfoley, cmiranda, cmoulliard, dhanak, dkreling, dpalmer, drichtar, ecerquei, fmariani, gmalinko, ibek, ikanello, janstey, jpoth, jrokos, jross, jscholz, kverlaen, lthon, mnovotny, mulliken, parichar, pcongius, pdelbell, pdrozd, peholase, pgallagh, pjindal, pskopek, rguimara, rkieley, rowaters, rruss, saroy, sthorger, swoodman, tasato, tcunning, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: springframework 6.1.6, springframework 6.0.19, springframework 5.3.34 Doc Type: ---
Doc Text:
A flaw was found in the Spring Framework. Applications that use UriComponentsBuilder to parse an externally provided URL, for example, through a query parameter, and perform validation checks on the host of the parsed URL may be vulnerable to an open redirect attack or an SSRF attack if the URL is used after passing validation checks.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2275258    

Description Mauro Matteo Cascella 2024-04-16 10:02:09 UTC 
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22259 and CVE-2024-22243, but with different input.

Upstream advisory:
https://spring.io/security/cve-2024-22262
Comment 3 errata-xmlrpc 2024-06-06 16:42:20 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 3.20.6 for Spring Boot

Via RHSA-2024:3708 https://access.redhat.com/errata/RHSA-2024:3708
Comment 4 Sandipan Roy 2024-06-13 15:50:27 UTC 
Red Hat Fuse 7 does not use the affected function, but the function is still available for user convenience which demands one to validate the input.