Denial of Service Vulnerability in libspring-java: STOMP Broker Exposure
Summary
CVE-2018-1257: Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through t... Affects libspring-java across 2 version ranges.
< 4.3.19-1
< e17569e64a12f1e31d60b524185f9e746a912e8d
Fixed in 4.3.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core component of the Spring Framework, widely used for building Java applications. It provides comprehensive support for messaging, including STOMP (Simple Text Oriented Messaging Protocol) over WebSocket. This functionality allows applications to handle real-time messaging efficiently. However, certain versions of libspring-java are vulnerable to a denial of service attack due to improper handling of STOMP messages, which can be exploited by malicious users.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1257, affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. It allows attackers to exploit STOMP over WebSocket endpoints with an in-memory STOMP broker. By crafting specific messages, an attacker can trigger a denial of service condition through regular expression processing, potentially overwhelming the application and causing it to become unresponsive. This vulnerability poses significant risks, especially for applications relying on real-time messaging capabilities.
How To Fix
Minimum fixed version
4.3.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling STOMP over WebSocket endpoints or implementing additional security measures such as input validation and rate limiting to mitigate the risk of denial of service attacks.
Conclusion
CVE-2018-1257 presents a significant risk to applications using vulnerable versions of libspring-java due to the potential for denial of service attacks. It is crucial to upgrade to a secure version to protect your application from exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2018-1257 is a vulnerability in the Spring Framework that allows attackers to exploit STOMP over WebSocket endpoints, leading to potential denial of service.
Versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17 of libspring-java are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
If you cannot upgrade immediately, consider disabling STOMP over WebSocket endpoints or implementing input validation and rate limiting as temporary measures.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
