org.springframework:spring-beans 4.3.21.RELEASE

Direct Vulnerabilities

Known vulnerabilities in the org.springframework:spring-beans package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data binding. An attacker can exhaust system memory by supplying a crafted property path with a large index value, causing unbounded allocation of list elements when the target object contains a self-populating list whose element type exposes sub-properties. Note: This is only exploitable if the application uses Spring's data binding infrastructure to apply user-supplied property paths onto a target object, the target object contains a self-populating list implementation as a property, and the list's element type exposes sub-properties. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.springframework:spring-beans` to version 7.0.9 or higher.	[,7.0.9)
H Relative Path Traversal org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Relative Path Traversal when deployed on non-compliant Servlet containers. An unauthenticated attacker could gain access to files and directories outside the intended web root. Notes: This is only exploitable if the application is deployed as a WAR or with an embedded Servlet container, the Servlet container does not reject suspicious sequences and the application serves static resources with Spring resource handling. Applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. This vulnerability was also fixed in the commercial versions 6.1.22 and 5.3.44. How to fix Relative Path Traversal? Upgrade `org.springframework:spring-beans` to version 6.2.10 or higher.	[,6.2.10)
M Denial of Service (DoS) org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Denial of Service (DoS) if it relies on data binding to set a `MultipartFile` or `javax.servlet.Part` to a field in a model object. How to fix Denial of Service (DoS)? Upgrade `org.springframework:spring-beans` to version 5.2.22.RELEASE, 5.3.20 or higher.	[,5.2.22.RELEASE)[5.3.0,5.3.20)
C Remote Code Execution (RCE) org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Remote Code Execution (RCE) via manipulation of `ClassLoader` that is achievable with a POST HTTP request. This could allow an attacker to execute a webshell on a victim's application (TomCat), or download arbitrary files from the server (Payara/Glassfish). Note: Current public exploits require victim applications to be built with JRE version 9 (or above) and to be deployed on either Tomcat, Payara, or Glassfish. However, we have confirmed that it is technically possible for additional exploits to work under additional application configurations as well. As such, while we recommend users prioritize first remediating against the configuration described above, for full protection, we also recommend upgrading all vulnerable versions to the fixed `spring-beans` version regardless of the application configuration. Update Log 31/03/2022 - Severity was raised from 8.1 to 9.8 08/04/2022 - Advisory was updated to reflect that Snyk's security research team was able to author a working PoC of this vulnerability against applications that are deployed on Payara (which is based on Glassfish). How to fix Remote Code Execution (RCE)? Upgrade `org.springframework:spring-beans` to version 5.2.20, 5.3.18 or higher.	[,5.2.20)[5.3.0,5.3.18)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the data binding. An attacker can exhaust system memory by supplying a crafted property path with a large index value, causing unbounded allocation of list elements when the target object contains a self-populating list whose element type exposes sub-properties.

Note: This is only exploitable if the application uses Spring's data binding infrastructure to apply user-supplied property paths onto a target object, the target object contains a self-populating list implementation as a property, and the list's element type exposes sub-properties.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.springframework:spring-beans to version 7.0.9 or higher.

[,7.0.9)

Relative Path Traversal

Affected versions of this package are vulnerable to Relative Path Traversal when deployed on non-compliant Servlet containers. An unauthenticated attacker could gain access to files and directories outside the intended web root.

Notes:

This is only exploitable if the application is deployed as a WAR or with an embedded Servlet container, the Servlet container does not reject suspicious sequences and the application serves static resources with Spring resource handling.
Applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration.
This vulnerability was also fixed in the commercial versions 6.1.22 and 5.3.44.

How to fix Relative Path Traversal?

Upgrade org.springframework:spring-beans to version 6.2.10 or higher.

[,6.2.10)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS) if it relies on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

How to fix Denial of Service (DoS)?

Upgrade org.springframework:spring-beans to version 5.2.22.RELEASE, 5.3.20 or higher.

[,5.2.22.RELEASE)[5.3.0,5.3.20)

Remote Code Execution (RCE)

Affected versions of this package are vulnerable to Remote Code Execution (RCE) via manipulation of ClassLoader that is achievable with a POST HTTP request. This could allow an attacker to execute a webshell on a victim's application (TomCat), or download arbitrary files from the server (Payara/Glassfish).

Note:

Current public exploits require victim applications to be built with JRE version 9 (or above) and to be deployed on either Tomcat, Payara, or Glassfish.
However, we have confirmed that it is technically possible for additional exploits to work under additional application configurations as well.
As such, while we recommend users prioritize first remediating against the configuration described above, for full protection, we also recommend upgrading all vulnerable versions to the fixed spring-beans version regardless of the application configuration.

Update Log

31/03/2022 - Severity was raised from 8.1 to 9.8
08/04/2022 - Advisory was updated to reflect that Snyk's security research team was able to author a working PoC of this vulnerability against applications that are deployed on Payara (which is based on Glassfish).

How to fix Remote Code Execution (RCE)?

Upgrade org.springframework:spring-beans to version 5.2.20, 5.3.18 or higher.

[,5.2.20)[5.3.0,5.3.18)

org.springframework:spring-beans@4.3.21.RELEASE

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically

Update Log