PT-2022-18576 · Eclipse+2 · Jetty+2

Jlleitschuh

+1

·

Published

2022-03-30

·

Updated

2024-08-03

·

CVE-2022-27772

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions spring-boot versions prior to version v2.2.11.RELEASE
Description The issue is related to temporary directory hijacking, impacting the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. This vulnerability allows a local attacker to potentially take over the application if they gain permission to write in the temporary directory used by embedded web servers like Tomcat and Jetty. The vulnerability exists due to a race condition where an attacker can create a directory before the Java code, allowing them to write or read files in that directory. This issue affects Unix-like systems and older versions of Mac OSX and Windows that share the system temporary directory among all users.
Recommendations For spring-boot versions prior to version v2.2.11.RELEASE, update to version v2.2.11.RELEASE or later to resolve the issue. As a temporary workaround, consider setting the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user to mitigate the vulnerability.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

Related Identifiers

CVE-2022-27772
GHSA-CM59-PR5Q-CW85

Affected Products

Jetty
Apache Tomcat
Spring Boot