VMware Spring Cloud Function Framework up to 4.0.7/4.1.1 Web Module missing initialization

Summaryinfo

A vulnerability classified as critical has been found in VMware Spring Cloud Function Framework up to 4.0.7/4.1.1. Affected by this issue is some unknown functionality of the component Web Module. The manipulation leads to missing initialization. This vulnerability is traded as CVE-2024-22271. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in VMware Spring Cloud Function Framework up to 4.0.7/4.1.1 and classified as critical. This issue affects some unknown processing of the component Web Module. The manipulation with an unknown input leads to a missing initialization vulnerability. Using CWE to declare the problem leads to CWE-456. The product does not initialize critical variables, which causes the execution environment to use unexpected values. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is using Spring Cloud Function Web module Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8 References https://spring.io/security/cve-2022-22979   https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/  History 2020-01-16: Initial vulnerability report published.

The advisory is shared at spring.io. The identification of this vulnerability is CVE-2024-22271 since 01/08/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/09/2024).

Upgrading to version 4.0.8 or 4.1.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• VMware

Name

• Spring Cloud Function Framework

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.1.0
• 4.1.1

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion