Overview
About vulnerability
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions
may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is
used with a BigDecimal or BigInteger operand and a large exponent value. Evaluation
of such an expression can consume excessive CPU time and JVM heap memory, leading to
application degradation or unavailability.
More precisely, an application can be vulnerable when all the following are true:
- The application accepts and evaluates untrusted or user-controlled SpEL expressions.
- A
BigDecimalorBigIntegervalue is accessible within the evaluation context — for example, but not limited to, as a named context variable, a property or field accessible anywhere in the reachable object graph, an element of a reachable collection or map, or the return value of a registered function.
When all conditions are met, an attacker can craft a SpEL expression using the power operator to trigger a computation that monopolizes a thread for minutes to hours and exhausts JVM heap memory, resulting in a Denial of Service.
Details
- Affected product:
- Apache CXF , Apache Log4j , Apache Struts , Apache Tapestry , Apache Tomcat , Eclipse Jetty , Spring , activemq , amqp-10-jms-spring-boot , artemis , azure-spring-data-cosmos , camel , castor , cocoon , crash , cypher-dsl , glassfish-hk2 , gora , grails-core , grails-data-mapping , grails-gsp , grails-plugin-converters , hornetq , java-sdk , jersey , karaf , micronaut-spring , pulsar , rest-assured , tika
- Affected packages:
- Spring Framework @ 6.2.12 (+11880 more)