Homepage
About Snyk

Reflected File Download (RFD) Affecting org.springframework:spring-web package, versions [5.2.0, 5.2.3) [5.1.0, 5.1.13) [5.0.0, 5.0.16)

0.0
high

Snyk CVSS

    Attack Complexity High
    User Interaction Required
    Scope Changed
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 62.53% (98th percentile)
Expand this section
NVD
7.5 high
Expand this section
Red Hat
8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORK-559346
  • published 22 Jan 2020
  • disclosed 16 Jan 2020
  • credit Roman Shalymov
Report a new vulnerability Found a mistake?

Introduced: 16 Jan 2020

CVE-2020-5398 Open this link in a new tab
CWE-494 Open this link in a new tab

How to fix?

Upgrade org.springframework:spring-web to version 5.2.3, 5.1.13, 5.0.16 or higher.

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Reflected File Download (RFD). A reflected file download attack is possible when the filename attribute of the Content-Disposition header is derived from user-supplied input.

PoC 

curl 'http://127.0.0.1:8080/?filename=sample&contents=Hello,%20World' --dump-header -