CVE-2024-22243 CVE-2024-22243: Spring Framework URL Parsing with Host Validation
Attackers can bypass host validation in Spring Framework to perform open redirects or SSRF attacks when parsing external URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-22243?
CVE-2024-22243 is a high-severity vulnerability in Spring Framework, published on 23 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
Weakness: CWE-601
Which versions are affected by CVE-2024-22243?
8 open source packages ship an affected version, including org.springframework:spring-web.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework:spring-web Maven | All versions to 5.2.25.RELEASE | None |
org.springframework:spring-web Maven | All versions to 5.2.25.RELEASE | None |
org.springframework:spring-web Maven | From 5.3.0 | 5.3.32 |
org.springframework:spring-web Maven | From 5.3.0 | 5.3.32 |
org.springframework:spring-web Maven | From 6.0.0 | 6.0.17 |
org.springframework:spring-web Maven | From 6.0.0 | 6.0.17 |
2 more packages
org.springframework:spring-web Maven | From 6.1.0 | 6.1.4 |
org.springframework:spring-web Maven | From 6.1.0 | 6.1.4 |
How do I fix CVE-2024-22243?
Upgrade org.springframework:spring-web to a fixed version for your release line: 5.3.32, 6.0.17 or 6.1.4.
Is CVE-2024-22243 being exploited?
There is no known exploitation of CVE-2024-22243 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as CLSA-2026-1773274547, DEBIAN-CVE-2024-22243, ECHO-6aef-bc09-6cff, GHSA-ccgv-vj62-xf9h, ROOT-APP-MAVEN-CVE-2024-22243, UBUNTU-CVE-2024-22243.