org.springframework:spring-beans@5.1.7.RELEASE vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.springframework:spring-beans package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Denial of Service (DoS)

org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.

Affected versions of this package are vulnerable to Denial of Service (DoS) if it relies on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

How to fix Denial of Service (DoS)?

Upgrade org.springframework:spring-beans to version 5.2.22.RELEASE, 5.3.20 or higher.

[,5.2.22.RELEASE) [5.3.0,5.3.20)
  • C
Remote Code Execution

org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object.

Affected versions of this package are vulnerable to Remote Code Execution via manipulation of ClassLoader that is achievable with a POST HTTP request. This could allow an attacker to execute a webshell on a victim's application (TomCat), or download arbitrary files from the server (Payara/Glassfish).

Note:

  • Current public exploits require victim applications to be built with JRE version 9 (or above) and to be deployed on either Tomcat, Payara, or Glassfish.

  • However, we have confirmed that it is technically possible for additional exploits to work under additional application configurations as well.

  • As such, while we recommend users prioritize first remediating against the configuration described above, for full protection, we also recommend upgrading all vulnerable versions to the fixed spring-beans version regardless of the application configuration.

Update Log

  • 31/03/2022 - Severity was raised from 8.1 to 9.8
  • 08/04/2022 - Advisory was updated to reflect that Snyk's security research team was able to author a working PoC of this vulnerability against applications that are deployed on Payara (which is based on Glassfish).

How to fix Remote Code Execution?

Upgrade org.springframework:spring-beans to version 5.2.20, 5.3.18 or higher.

[,5.2.20) [5.3.0,5.3.18)