5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-38820

CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-38820

CVE-2024-38820:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework:spring-context	maven	< 6.1.14	6.1.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2024-38820 specifically states that the issue lies in DataBinder's handling of disallowedFields patterns becoming case-insensitive due to String.toLowerCase(), which has locale-dependent exceptions. This can result in fields not being protected as expected. The provided commit 23656aebc6c7d0f9faff1080981eb4d55eff296c directly addresses this by changing toLowerCase() to toLowerCase(Locale.ROOT) in DataBinder.java.

The two functions identified, org.springframework.validation.DataBinder.setDisallowedFields and org.springframework.validation.DataBinder.isAllowed, are central to this mechanism. setDisallowedFields processes and stores the patterns, and isAllowed performs the check against incoming field names. The use of locale-sensitive toLowerCase() in both these functions (prior to the patch) is the root cause of the vulnerability, as it could lead to inconsistent string comparisons across different locales, thereby failing to disallow fields that were intended to be blocked.

While the commit includes similar Locale.ROOT changes in many other files across the Spring Framework, these are considered preventative measures against similar locale-dependent issues. The core vulnerability described by CVE-2024-38820 is pinpointed to the DataBinder's disallowedFields functionality. Therefore, the functions within DataBinder.java that handle these fields are the directly vulnerable ones according to the CVE's description.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.