Denial of Service Vulnerability in libspring-java Package
Summary
DEBIAN-CVE-2022-22971: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user. Affects libspring-java versions 4.3.30-1 – 4.3.30-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a core component of the Spring Framework, which is widely used for building enterprise-level applications in Java. It provides comprehensive infrastructure support for developing Java applications, including features for web applications, data access, and messaging. The package is crucial for applications that utilize STOMP (Simple Text Oriented Messaging Protocol) over WebSocket for real-time communication. However, certain versions of this package are vulnerable to a denial of service attack, which can be exploited by authenticated users.
Vulnerability Detail
The vulnerability, identified as CVE-2022-22971, affects versions of the Spring Framework prior to 5.3.20 and 5.2.22, as well as older unsupported versions. It allows an authenticated user to launch a denial of service attack against applications that expose a STOMP over WebSocket endpoint. This can lead to service disruptions, making the application unresponsive to legitimate users. The issue arises from improper handling of WebSocket connections, which can be exploited to overwhelm the server resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on WebSocket connections to mitigate the impact of potential denial of service attacks. This can help control the number of connections from a single authenticated user and reduce the risk of overwhelming the server.
Conclusion
The libspring-java package has a critical vulnerability that can be exploited by authenticated users to cause denial of service. It is crucial for users to update to the latest patched versions to protect their applications. Implementing rate limiting can serve as a temporary measure while updates are applied.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2022-22971 is a vulnerability in the Spring Framework that allows authenticated users to perform denial of service attacks on applications using STOMP over WebSocket.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions prior to 5.3.20 and 5.2.22, as well as older unsupported versions of libspring-java, are vulnerable to this issue.
The primary consequence is a denial of service, where the application may become unresponsive to legitimate users due to resource exhaustion.
Rate limiting can be implemented at the application level by restricting the number of WebSocket connections or messages from a single user within a specified timeframe.
References
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
