CVE-2024-38820

LOW

Spring Framework 5.3.0-5.3.40 and 6.1.0-6.1.13 - Case Sensitivity Bypass in DataBinder DisallowedFields

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-38820. PoCs published by kadamnayan.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2024-38820, demonstrating a locale-dependent bypass vulnerability in Spring Framework's DataBinder field protection mechanism. The PoC includes a Spring Boot application and test scripts to exploit the vulnerability by leveraging Turkish locale-specific case conversion issues.

Description

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Exploits (1)

nomisec WORKING POC

by kadamnayan · poc

https://github.com/kadamnayan/POC-CVE-2024-38820

View Code ZIP pw:eip

This repository contains a functional proof-of-concept for CVE-2024-38820, demonstrating a locale-dependent bypass vulnerability in Spring Framework's DataBinder field protection mechanism. The PoC includes a Spring Boot application and test scripts to exploit the vulnerability by leveraging Turkish locale-specific case conversion issues.

Classification

Working Poc 100%

Attack Type

Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: Spring Framework 5.3.x (before 5.3.40), 6.0.x (before 6.0.24), 6.1.x (before 6.1.13)

No auth needed

Prerequisites: Spring Framework with vulnerable DataBinder implementation · Application running with Turkish or other locale-sensitive environment

MITRE ATT&CK

T1552 - Unsecured Credentials T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Core References

Vendor Advisory

https://spring.io/security/cve-2024-38820

Vendor Advisory

https://security.netapp.com/advisory/ntap-20241129-0003/

Scores

CVSS v3 3.1

EPSS 0.0147

EPSS Percentile 81.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-178

Status published

Products (3)

org.springframework/spring-context 6.1.0 - 6.1.14Maven

org.springframework/spring-web 6.1.0 - 6.1.14Maven

vmware/spring_framework 5.3.0 - 5.3.41

Published Oct 18, 2024

Tracked Since Feb 18, 2026