Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-38807

CVE-2024-38807: Signature forgery in Spring Boot's Loader

6.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-38807
GHSA ID
GHSA-7cj3-x93g-gj76
EPSS Score
0.0245%
CWE
CWE-347
Published
8/23/2024
Updated
1/17/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.springframework.boot:spring-boot-loadermaven>= 2.7.0, <= 2.7.212.7.22
org.springframework.boot:spring-boot-loader-classicmaven>= 2.7.0, <= 2.7.212.7.22
org.springframework.boot:spring-boot-loadermaven>= 3.0.0, <= 3.0.163.0.17
org.springframework.boot:spring-boot-loader-classicmaven>= 3.0.0, <= 3.0.163.0.17
org.springframework.boot:spring-boot-loadermaven>= 3.1.0, <= 3.1.123.1.13
org.springframework.boot:spring-boot-loader-classicmaven>= 3.1.0, <= 3.1.123.1.13
org.springframework.boot:spring-boot-loadermaven>= 3.2.0, <= 3.2.83.2.9
org.springframework.boot:spring-boot-loader-classicmaven>= 3.2.0, <= 3.2.83.2.9
org.springframework.boot:spring-boot-loadermaven>= 3.3.0, <= 3.3.23.3.3
org.springframework.boot:spring-boot-loader-classicmaven>= 3.3.0, <= 3.3.23.3.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper isolation of cryptographic signature contexts in nested JAR processing. Based on the CWE-347 description and Spring Boot's architecture:

  1. The JarFile class is central to nested JAR handling, and its signature verification logic would need to maintain strict separation between layers.
  2. The JarEntryCertification class (hypothetical name based on pattern) likely handles entry-specific validation, where improper signer association could occur.
  3. Confidence is medium due to lack of direct patch/diff access, but inferred from:
    • The vulnerability's focus on nested JAR signature isolation
    • Spring Boot's known JAR handling architecture
    • The CWE's emphasis on verification context management
    • Version ranges suggesting changes in JAR loading logic

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ppli**tions t**t us* sprin*-*oot-lo***r or sprin*-*oot-lo***r-*l*ssi* *n* *ont*in *ustom *o** t**t p*r*orms si*n*tur* v*ri*i**tion o* n*st** j*r *il*s m*y ** vuln*r**l* to si*n*tur* *or**ry w**r* *ont*nt t**t *pp**rs to **v* ***n si*n** *y on* si*n*

Reasoning

T** vuln*r**ility st*ms *rom improp*r isol*tion o* *rypto*r*p*i* si*n*tur* *ont*xts in n*st** J*R pro**ssin*. **s** on t** *W*-*** **s*ription *n* Sprin* *oot's *r**it**tur*: *. T** `J*r*il*` *l*ss is **ntr*l to n*st** J*R **n*lin*, *n* its si*n*tur*