PT-2022-18576 · Eclipse+2 · Jetty+2
Jlleitschuh
+1
·
Published
2022-03-30
·
Updated
2024-08-03
·
CVE-2022-27772
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
spring-boot versions prior to version v2.2.11.RELEASE
Description
The issue is related to temporary directory hijacking, impacting the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. This vulnerability allows a local attacker to potentially take over the application if they gain permission to write in the temporary directory used by embedded web servers like Tomcat and Jetty. The vulnerability exists due to a race condition where an attacker can create a directory before the Java code, allowing them to write or read files in that directory. This issue affects Unix-like systems and older versions of Mac OSX and Windows that share the system temporary directory among all users.
Recommendations
For spring-boot versions prior to version v2.2.11.RELEASE, update to version v2.2.11.RELEASE or later to resolve the issue.
As a temporary workaround, consider setting the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user to mitigate the vulnerability.
Exploit
Fix
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Jetty
Apache Tomcat
Spring Boot