Expression Language Injection Affecting org.springframework:spring-core package, versions [2.0.0, 2.5.6.SEC03) [3.0.0, 3.0.6)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORK-30157
- published 9 Sep 2011
- disclosed 9 Sep 2011
- credit Stefano Di Paola, Arshan Dabirsiaghi
How to fix?
Upgrade org.springframework:spring-core to version 2.5.6.SEC03, 3.0.6 or higher.
Overview
org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.
Affected versions of this package are vulnerable to Expression Language Injection. When a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."