CVE-2024-22271 Spring Cloud Function Web DOS Vulnerability
Attackers can cause denial of service in Spring Cloud Function Web applications by composing functions with non-existing functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22271?
CVE-2024-22271 is a high-severity denial of service vulnerability in Spring Cloud Function Framework, published on 9 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.
Specifically, an application is vulnerable when all of the following are true:
User is using Spring Cloud Function Web module
Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8
References https://spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ History 2020-01-16: Initial vulnerability report published.
Weakness: CWE-20
Which versions are affected by CVE-2024-22271?
4 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-function-context.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-function-context Maven | From 4.0.0 | 4.0.8 |
org.springframework.cloud:spring-cloud-function-context Maven | From 4.0.0 | 4.0.8 |
org.springframework.cloud:spring-cloud-function-context Maven | From 4.1.0 | 4.1.2 |
org.springframework.cloud:spring-cloud-function-context Maven | From 4.1.0 | 4.1.2 |
How do I fix CVE-2024-22271?
Upgrade org.springframework.cloud:spring-cloud-function-context to a fixed version for your release line: 4.0.8 or 4.1.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-22271 being exploited?
There is no known exploitation of CVE-2024-22271 in the wild and no public exploit code.
Sources
Also known as GHSA-j4r7-p9fp-w3f3.