CVE-2024-22271: Denial of Service in Spring Cloud Function Framework
Summary
CVE-2024-22271: Spring Cloud Function Framework vulnerable to Denial of Service. Affects org.springframework.cloud:spring-cloud-function-context across 2 version ranges.
>= 4.0.0, < 4.0.8
>= 4.1.0, < 4.1.2
Fixed in 4.0.8 or 4.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Cloud Function is a framework that allows developers to write functions that can be deployed as standalone applications or as part of a larger microservices architecture. It provides a simple programming model and runtime support for serverless functions. The 'org.springframework.cloud:spring-cloud-function-context' package is a core component of the framework, providing the necessary context and utilities for function composition and execution.
Vulnerability Detail
The Spring Cloud Function framework, specifically versions 4.1.x prior to 4.1.2 and 4.0.x prior to 4.0.8, is vulnerable to a Denial of Service (DOS) attack. This vulnerability occurs when attempting to compose functions with non-existing functions. An attacker can exploit this vulnerability to overload the application and cause it to become unresponsive or crash. The vulnerability affects applications that use the Spring Cloud Function Web module.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.0.84.0.8 -
>= 4.1.0, < 4.1.24.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed versions of the 'org.springframework.cloud:spring-cloud-function-context' package.
Conclusion
The Spring Cloud Function framework is vulnerable to a Denial of Service (DOS) attack when attempting to compose functions with non-existing functions. Upgrading to the fixed versions of the 'org.springframework.cloud:spring-cloud-function-context' package is necessary to mitigate the vulnerability and ensure the proper handling of function composition.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-function-context →
FAQ
Spring Cloud Function is a framework for writing serverless functions that can be deployed as standalone applications or as part of a microservices architecture.
The 'org.springframework.cloud:spring-cloud-function-context' package is a core component of the Spring Cloud Function framework, providing context and utilities for function composition and execution.
A Denial of Service (DOS) attack is an attempt to make a computer or network resource unavailable to its intended users, typically by overwhelming the target system with a flood of incoming requests or by exploiting a vulnerability to cause the system to crash or become unresponsive.
This vulnerability can be exploited by an attacker who can send requests to the application with non-existing functions, causing the application to consume excessive resources and become unresponsive or crash.
No, only versions 4.1.x prior to 4.1.2 and 4.0.x prior to 4.0.8 are affected. It is recommended to upgrade to the fixed versions to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.cloud:spring-cloud-function-context.
