-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe Reflected File Download (RFD) vulnerability in Spring Framework (CVE-2025-41234) occurs when an application constructs a Content-Disposition header where the filename is derived from user input and a non-ASCII charset is used.
The root cause lies in the improper encoding of certain characters, particularly double quotes ("), in the filename attribute of the header.
Two key functions are involved in this vulnerability:
org.springframework.http.ContentDisposition$Builder.filename(String filename, java.nio.charset.Charset charset): This is the method applications use to set the filename and specify a non-ASCII charset. It acts as the entry point for the user-supplied, potentially malicious filename. If an attacker can control this input, they can introduce characters that, if not properly encoded, can manipulate the browser's interpretation of the downloaded file's name and type.
org.springframework.http.ContentDisposition.appendTo(java.lang.StringBuilder) (and helper methods called during serialization, e.g., via toString()): This method is responsible for serializing the ContentDisposition object's state, including the filename, into the final HTTP header string. Internally, it relies on a BitSet called PRINTABLE to determine which characters need to be percent-encoded. Before the patch, the PRINTABLE set incorrectly considered double quotes as safe (printable) in the context of filename* encoding with non-ASCII charsets. This meant that if a filename like "setup.bat was provided via the builder with a UTF-8 charset, the quotes might not be encoded in the filename* part of the header, leading to the RFD.
The patch (f0e7b42704e6b33958f242d91bd690d6ef7ada9c) addresses the vulnerability by modifying the static initializer of the ContentDisposition class to explicitly mark the double quote character (", ASCII 34) as non-printable (PRINTABLE.set(34, false);). This ensures that during the serialization process performed by appendTo (and its callees), double quotes in filenames are correctly encoded, preventing the RFD attack vector.
Therefore, an exploit would involve an application calling ContentDisposition.Builder.filename() with attacker-controlled input and a non-ASCII charset. Subsequently, when Spring Framework serializes this ContentDisposition object to a header (triggering appendTo/toString()), the vulnerability would manifest if the older, unpatched code was used.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework:spring-web | maven | >= 6.2.0, < 6.2.8 | 6.2.8 |
| org.springframework:spring-web | maven | >= 6.1.0, < 6.1.21 | 6.1.21 |
| org.springframework:spring-web | maven | >= 6.0.5, <= 6.0.23 |