CVE-2024-22262: spring spring framework Open Redirect

Vulnerability summary

CVE-2024-22262 is a high (CVSS 8.1) Open Redirect vulnerability in spring spring framework. EPSS estimates a 1.19% chance of exploitation in the next 30 days, higher than 67.4% of scored vulnerabilities.

Timeline

1. 16-04-2024
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.