4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-38808

CVE-2024-38808: Spring Framework vulnerable to Denial of Service

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.

Specifically, an application is vulnerable when the following is true:

The application evaluates user-supplied SpEL expressions.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-38808

CVE-2024-38808:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework:spring-expression	maven	< 5.3.39	5.3.39

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description indicates that specially crafted SpEL expressions can cause a Denial of Service. The provided patches modify core SpEL evaluation logic to add restrictions. Commit 26f2dad388499faecf99e75b8856788e95d8d658 introduces a mechanism (isAssignmentEnabled) to disable assignment-like operations (assignment, increment, decrement) in certain evaluation contexts. The functions Assign.getValueInternal, OpDec.getValueInternal, and OpInc.getValueInternal were modified to respect this new flag. Prior to this, they would execute these operations without this check, making them vulnerable points if an attacker could control the SpEL expression and the evaluation context didn't otherwise restrict these operations. Commit f44d13cb7816e586b86c02421af4f5498391111c modifies ConstructorReference.createArray to prevent array construction if no constructor resolvers are present in the evaluation context. This suggests that uncontrolled array creation was another vector for the DoS, potentially leading to excessive memory allocation. These four functions are directly responsible for processing the SpEL constructs that were exploitable. During a DoS attack leveraging this vulnerability, these functions, in their pre-patch state, would be the ones executing the harmful logic (e.g., attempting large allocations or performing unrestricted assignments/modifications). Therefore, they would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.