Bug 2275257 (CVE-2024-22262) - CVE-2024-22262 springframework: URL Parsing with Host Validation
Summary: CVE-2024-22262 springframework: URL Parsing with Host Validation
Keywords:
Status: NEW
Alias: CVE-2024-22262
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2275258
TreeView+ depends on / blocked
 
Reported: 2024-04-16 10:02 UTC by Mauro Matteo Cascella
Modified: 2024-06-13 15:50 UTC (History)
48 users (show)

Fixed In Version: springframework 6.1.6, springframework 6.0.19, springframework 5.3.34
Doc Type: ---
Doc Text:
A flaw was found in the Spring Framework. Applications that use UriComponentsBuilder to parse an externally provided URL, for example, through a query parameter, and perform validation checks on the host of the parsed URL may be vulnerable to an open redirect attack or an SSRF attack if the URL is used after passing validation checks.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:3708 0 None None None 2024-06-06 16:42:23 UTC

Description Mauro Matteo Cascella 2024-04-16 10:02:09 UTC 
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22259 and CVE-2024-22243, but with different input.

Upstream advisory:
https://spring.io/security/cve-2024-22262
Comment 3 errata-xmlrpc 2024-06-06 16:42:20 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 3.20.6 for Spring Boot

Via RHSA-2024:3708 https://access.redhat.com/errata/RHSA-2024:3708
Comment 4 Sandipan Roy 2024-06-13 15:50:27 UTC 
Red Hat Fuse 7 does not use the affected function, but the function is still available for user convenience which demands one to validate the input.
Note You need to log in before you can comment on or make changes to this bug.