Server-Side Request Forgery (SSRF) in Spring Framework - CVE-2024-22262

Vulnerability identifier: #VU89801

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2024-22262

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input when parsing URL with the UriComponentsBuilder component. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Note, this vulnerability exists due to incomplete fix for #VU87614 (CVE-2024-22259) and #VU86695 (CVE-2024-22243).

Spring Framework
Confluence Data Center
IBM Process Mining
Crowd Data Center
Bitbucket Data Center
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Enterprise Case Management
Oracle Financial Services Model Management and Governance
Oracle Healthcare Data Repository
Bamboo Server
Oracle SD-WAN Edge
Oracle Middleware Common Libraries and Tools
Oracle WebCenter Forms Recognition
Oracle Banking APIs
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Network Exposure Function
Management Cloud Engine
Oracle Communications Cloud Native Core Network Data Analytics Function
Oracle Communications EAGLE Element Management System
IBM MaaS360 Mobile Enterprise Gateway
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM SPSS Collaboration and Deployment Services
IBM Security Verify Governance
IBM Business Automation Workflow
IBM Observability with Instana
Confluence Server
watsonx.data
Oracle Solaris Cluster
OpenPages for IBM Cloud Pak for Data
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Oracle Healthcare Master Person Index
Oracle Financial Services Analytical Applications Infrastructure
OpenPages Cloud pak for data service version
IBM Engineering Requirements Management DOORS Next
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
Oracle FLEXCUBE Universal Banking
Storage Copy Data Management
Analytics Content Hub
Cloud Pak for Network Automation
IBM Cloud Pak for Watson AIOps
Storage Resource Manager
Oxygen Feedback
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
Dell Policy Manager for Secure Connect Gateway (SCG)
IBM Sterling Connect:Direct for Microsoft Windows
Maximo Application Suite - Monitor Component
Crowd Server
IBM Tivoli Application Dependency Discovery Manager
Oracle Financial Services Compliance Studio
Oracle Insurance Policy Administration
Oracle Banking Corporate Lending Process Management
Oracle Banking Cash Management
Oracle Banking Branch
Oracle Banking Virtual Account Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Liquidity Management
Oracle Banking Origination
Juniper Secure Analytics (JSA)
QRadar Suite
Bitbucket Server
Oracle WebLogic Server
Primavera Gateway
MySQL Enterprise Monitor
Oracle Communications BRM - Elastic Charging Engine
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Retail Financial Integration
Oracle Retail Assortment Planning
Oracle Documaker
Planning Analytics Local
Oracle Retail Integration Bus
Primavera Unifier
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Service Communication Proxy
Library Support for Spring
IBM MaaS360 VPN Module
Red Hat Camel for Spring Boot
Dell EMC Storage Monitoring and Reporting (SMR)
IBM Qradar SIEM
IBM Cognos Controller

Install updates from vendor's website.

Spring Framework - addressed in versions 5.3.34, 6.0.19, 6.1.6
Confluence Data Center - addressed in versions 7.19.24, 8.5.11, 8.9.3
Confluence Server - addressed in versions 7.19.24, 8.5.11, 8.9.3
IBM Process Mining - update to 1.15.0
watsonx.data - update to 2.1
OpenPages for IBM Cloud Pak for Data - update to 5.3.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
Crowd Data Center - addressed in versions 5.1.11, 5.2.6, 5.3.3, 6.0.1
Crowd Server - addressed in versions 5.1.11, 5.2.6, 5.3.3, 6.0.1
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
Bitbucket Server - addressed in versions 8.9.14, 8.19.3
Bitbucket Data Center - addressed in versions 8.9.14, 8.19.3
Bamboo Server - addressed in versions 9.2.14, 9.6.3
OpenPages Cloud pak for data service version - update to 9.6.0
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
Oracle Communications BRM - Elastic Charging Engine - update to 12.0.0.8.0
QRadar Suite - update to 1.10.22.0
Planning Analytics Local - addressed in versions 2.0.0.96, 2.1.3
Storage Copy Data Management - update to 2.2.26.0
Analytics Content Hub - update to 2.3
Cloud Pak for Network Automation - update to 2.7.5
Library Support for Spring - update to 2.7.29
IBM MaaS360 Mobile Enterprise Gateway - update to 3.000.800
IBM MaaS360 VPN Module - update to 3.000.800
Red Hat Camel for Spring Boot - update to 3.20.6
IBM Cloud Pak for Watson AIOps - update to 4.6.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.2.0
Storage Resource Manager - update to 5.0.2.0
Oxygen Feedback - update to 5.0 2024090417
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
watsonx Assistant Cartridge - update to 5.1.1
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.24.00.14
Dell Secure Connect Gateway - update to 5.28.00.14
IBM Sterling Connect:Direct for Microsoft Windows - update to 6.3.0.3 iFix002
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF03
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.13
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
IBM Security Verify Governance - update to 10.0.2.0.3
IBM Cognos Controller - addressed in versions 11.0.1.4, 11.1.0.2
IBM Business Automation Workflow - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1.0
IBM Observability with Instana - update to 272

• https://spring.io/security/cve-2024-22262

• SSRF in Pivotal Spring Framework
• Bitbucket Data Center and Server update for Pivotal Spring Framework
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM MaaS360 Cloud Extender Mobile Enterprise Gateway (MEG) and VPN Module
• Multiple vulnerabilities in Dell Secure Connect Gateway Policy Manager
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 3.20
• Confluence Data Center and Server update for spring-web
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Server-side request forgery in IBM Process Mining
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Sterling Connect:Direct for Microsoft Windows
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle Communications EAGLE Element Management System
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Data Analytics Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Server-Side Request Forgery (SSRF) in Primavera Gateway
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Commerce Platform
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
• Server-Side Request Forgery (SSRF) in Oracle Financial Services Enterprise Case Management
• Multiple vulnerabilities in Oracle Financial Services Compliance Studio
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Banking Virtual Account Management
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Credit Facilities Process Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in Oracle Banking Branch
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Oracle Documaker
• Multiple vulnerabilities in Oracle Insurance Policy Administration J2EE
• Server-Side Request Forgery (SSRF) in Oracle Healthcare Master Person Index
• Multiple vulnerabilities in Oracle Healthcare Data Repository
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Server-Side Request Forgery (SSRF) in Oracle Retail Integration Bus
• Server-Side Request Forgery (SSRF) in Oracle Retail Financial Integration
• Server-Side Request Forgery (SSRF) in Oracle Retail Assortment Planning
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM QRadar Suite Software
• Bamboo Data Center and Server update for Spring Framework spring-web
• Multiple vulnerabilities in IBM Security Verify Governance
• Crowd Data Center and Server update for spring-web
• Server-Side Request Forgery (SSRF) in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Oxygen Feedback update for Spring Framework
• Multiple vulnerabilities in Management Cloud Engine
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in Oracle WebCenter Forms Recognition
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in Oracle Solaris Cluster
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• SPSS Collaboration and Deployment Services update for Spring Framework
• Multiple vulnerabilities in IBM Analytics Content Hub
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in Dell Secure Connect Gateway
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for spring-web
• Multiple vulnerabilities in IBM Library Support for Spring
• Multiple vulnerabilities in IBM OpenPages for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS and DOORS Web Access
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition