PT-2023-8403 · Spring+2 · Spring Webflux+4

James Yuzawa · Published 2023-11-27 · Updated 2023-12-14 · CVE-2023-34053

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Spring Framework versions 6.0.0 through 6.0.13

Description The issue is related to unlimited resource distribution, which can be exploited by a remote attacker to cause a denial-of-service (DoS) condition using specially crafted HTTP requests. This can happen when the application uses Spring MVC or Spring WebFlux, has io.micrometer:micrometer-core on the classpath, and an ObservationRegistry is configured to record observations. Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet these conditions.

Recommendations For Spring Framework versions 6.0.0 through 6.0.13, consider disabling the use of Spring MVC or Spring WebFlux, or removing io.micrometer:micrometer-core from the classpath, until a patch is available. Additionally, restricting the configuration of ObservationRegistry to prevent recording observations can help minimize the risk of exploitation. Avoid using the org.springframework.boot:spring-boot-actuator dependency in Spring Boot applications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-00651

CVE-2023-34053

GHSA-V94H-HVHG-MF9H

Affected Products

Spring Framework

Spring Mvc

Spring Webflux

Micrometer-Core

Spring-Boot-Actuator

References · 14

• https://spring.io/security/cve-2023-34053 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v94h-hvhg-mf9h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34053 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-34053 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-34053 · Security Note
• https://bdu.fstec.ru/vul/2024-00651 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34053 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-34053 · Vendor Advisory
• https://github.com/spring-projects/spring-framework · Note
• https://github.com/spring-projects/spring-framework/compare/v6.0.13...v6.0.14 · Note
• https://github.com/spring-projects/spring-framework/commit/c18784678df489d06a70e54fcddb5e3821d4b00c · Note
• https://security.netapp.com/advisory/ntap-20231214-0007 · Note
• https://t.me/cvenotify/63678 · Telegram Post
• https://t.me/cvenotify/61316 · Telegram Post