CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
Other sources
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243, but with different input.
— GitHub
VMware Tanzu Spring Framework could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in UriComponentsBuilder. An attacker could exploit this vulnerability using a specially-crafted URL to redirect a victim to arbitrary Web sites.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22259?
CVE-2024-22259 is classified with a high severity due to the potential for open redirect attacks.
How do I fix CVE-2024-22259?
To fix CVE-2024-22259, update to Spring Framework versions 5.3.33, 6.0.18, or 6.1.5.
What software is affected by CVE-2024-22259?
CVE-2024-22259 affects applications using UriComponentsBuilder in Spring Framework versions prior to the specified remedial versions.
What type of attack does CVE-2024-22259 enable?
CVE-2024-22259 enables open redirect attacks where attackers can manipulate redirects to unauthorized locations.
Is there a workaround for CVE-2024-22259?
There are no specific workarounds for CVE-2024-22259; the recommended action is to update the affected software.