Spring Framework STOMP over WebSocket Security Bypass Vulnerability Allowing Unauthorized Message Transmission

A security bypass vulnerability has been identified in STOMP over WebSocket applications using Spring Framework. This vulnerability allows attackers to send unauthorized messages. It affects multiple Spring Framework versions, including 6.2.0 through 6.2.11, 6.1.0 through 6.1.23, 6.0.x prior to 6.0.29, and 5.3.0 through 5.3.45. Older, unsupported versions are also vulnerable.

Impact

Exploitation of this vulnerability could lead to unauthorized message transmission in STOMP over WebSocket applications, potentially allowing attackers to inject messages into the communication stream.

Remediation

Users of affected Spring Framework versions should upgrade to the following fixed versions: 6.2.x users should upgrade to 6.2.12, 6.1.x users should upgrade to 6.1.24, and 5.3.x users should upgrade to 5.3.46. Instructions for obtaining these versions are available on the Spring Enterprise website.