Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-22044

CVE-2021-22044: Exposure of Resource to Wrong Sphere in Spring Cloud OpenFeign

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-22044
GHSA ID
GHSA-pf94-6v2v-cm3j
EPSS Score
0.57454%
CWE
CWE-668
Published
5/24/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.springframework.cloud:spring-cloud-openfeign-coremaven>= 3.0.0, <= 3.0.43.0.5
org.springframework.cloud:spring-cloud-openfeign-coremaven>= 2.2.0, <= 2.2.92.2.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from processing class-level @RequestMapping annotations on Feign client interfaces. The key vulnerable functions are:

  1. processAnnotationOnClass: Directly handled class-level path mapping through the removed path prepending logic
  2. parseAndValidateMetadata: Indirectly enabled exposure through class-level header/produces/consumes inheritance Both were modified in the patch to reject class-level annotations and remove inheritance behavior. These functions would appear in stack traces when Spring processes Feign client interfaces with type-level @RequestMapping annotations, as they're responsible for translating annotations into HTTP endpoint mappings.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In Sprin* *lou* Op*n**i*n *.*.* to *.*.*, *.*.*.R*L**S* to *.*.*.R*L**S*, *n* ol**r unsupport** v*rsions, *ppli**tions usin* typ*-l*v*l `@R*qu*stM*ppin*`*nnot*tions ov*r **i*n *li*nt int*r****s, **n ** involunt*rily *xposin* *n*points *orr*spon*in* t

Reasoning

T** vuln*r**ility st*ms *rom pro**ssin* *l*ss-l*v*l @R*qu*stM*ppin* *nnot*tions on **i*n *li*nt int*r****s. T** k*y vuln*r**l* *un*tions *r*: *. pro**ss*nnot*tionOn*l*ss: *ir**tly **n*l** *l*ss-l*v*l p*t* m*ppin* t*rou** t** r*mov** p*t* pr*p*n*in* l