CVE-2022-22970

MEDIUM

Denial of service in Spring Framework

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-22970 has a selected CVSS score of 5.3 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Affected products and versions

2
ProductSourceVersion range

Spring Framework

CVE ListSpring Framework versions 5.3.x prior to 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versionsaffected

org.springframework:spring-beans

Browse Maven / org.springframework:spring-beans
GitHub AdvisoryBefore 5.2.22.RELEASE · Fixed in 5.2.22.RELEASEaffected
5.3.0 to < 5.3.20 · Fixed in 5.3.20affected

Proofs of concept

1

Repository PoCs

GitHubPerformant-Labs/CVE-2022-22970Repository PoCby Performant-Labs0Not analyzed14 files

92.6 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

.devcontainer

Performant-Labs/CVE-2022-22970Created Vuln labCVE-2022-22970Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A DevContainer environment based on a Java 17 image, with Maven and Microsoft OpenJDK installed, intended for exploring CVE-2022-22970 in a Spring application.

README.md:1-5.devcontainer/Dockerfile:1-53

Lab assessment

Vulnerability lab

The README explicitly states the repository contains a Development Container environment and Spring application to explore CVE-2022-22970, and provides setup and exploit instructions.

README.md:1-5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

DevContainer Dockerfile

builds the development environment

Defines a container based on mcr.microsoft.com/devcontainers/java:17-bullseye, installs Maven, wget, ca-certificates, downloads and verifies Microsoft OpenJDK 17, sets up aliases, creates /workspace, and switches to vscode user.

.devcontainer/Dockerfile:1-53

Spring application harness

vulnerable target application

Referenced in the README as a Spring application located in the spring-cve-harness directory, run via Maven, and intended to be exploited for CVE-2022-22970. The application source is not included in the supplied evidence.

README.md:1-5README.md:24-27
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-22970

Insufficient evidence

The README claims the environment is for exploring CVE-2022-22970, but no exploit code, vulnerable dependency, or configuration demonstrating the CVE is present in the supplied evidence.

README.md:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and an IDE, or GitPod, to build and run the DevContainer.README.md:7-9
  • The Spring application source code in the spring-cve-harness directory (not included in evidence).README.md:24-27

Evidence-described exercise path

  1. Clone the repository and open it in a DevContainer-compatible environment (local Docker/IDE or GitPod).README.md:7-21
  2. Navigate to the spring-cve-harness directory and run the Spring application with Maven.README.md:24-27
  3. Perform the exploit (details not provided in evidence).README.md:28
Safety-review evidence

Behaviors behind the stored safety assessment

Insufficient evidence

The Dockerfile performs standard DevContainer setup with no suspicious commands. The README describes an exploit exercise but provides no exploit code or behavior. Without the application source or exploit details, the safety of the exercise cannot be assessed.

.devcontainer/Dockerfile:1-53README.md:1-48
Review boundaries

What the analysis did not establish

  • The Spring application source code (spring-cve-harness) is not included in the evidence.
  • No exploit code or detailed exploit steps are provided.
  • The devcontainer.json file is listed in the inventory but its content is not included in the evidence.
  • The actual behavior of the exploit and its target scope (container-only, host, external) cannot be determined.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

7