Spring Framework Server-Side Request Forgery Vulnerability in UriComponentsBuilder

A server-side request forgery (SSRF) vulnerability has been identified in Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18. The issue arises from incorrect host parsing in the UriComponentsBuilder, allowing applications that use this component to validate externally provided URL strings to be exploited.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can manipulate the server to make requests on its behalf, potentially accessing internal resources or services.

Remediation

Users should upgrade to Spring Framework 7.0.8 or 6.2.19. For commercial users, the fixed versions are 7.0.7.1 and 6.2.18.1.