QID 379405

Applications that use 'UriComponentsBuilder' to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.

Affected Versions:
Spring Framework 6.1.0 - 6.1.3
Spring Framework 6.0.0 - 6.0.16
Spring Framework 5.3.0 - 5.3.31
Older, unsupported versions of Spring Framework are also affected

QID Detection Logic (Authenticated) - Linux
This QID executes the following commands to detect if spring-core-*.jar is present on the system.

• locate -b -e -r '^spring\-core.*\.jar$
• ls -l /proc/*/fd | grep -Eo '\S+\/spring\S+jar' | uniq 2> /dev/null

QID Detection Logic (Authenticated) - Windows
This QID checks for vulnerable version of spring core in running processes using a WMI query.

QID Detection: (Authenticated) - MacOS
This QID executes the 'mdfind' command to check for the presence of spring-core jar on a system.

The vulnerability, if exploited successfully, could enable attackers to deceive a user into visiting a crafted link. This link could then redirect the user to any harmful external website chosen by the attacker.