CVE-2021-22118

Q: What is the severity of CVE-2021-22118?

CVE-2021-22118 has a CVSS score of 7.8 (HIGH). This vulnerability allows a locally authenticated malicious user to escalate privileges in Spring Framework WebFlux applications by manipulating temporary storage directories. Attackers can read or modify uploaded files or overwrite arbitrary files with multipart request data. Affects Spring Framework versions 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7.

7.8 HIGH

📋 TL;DR

This vulnerability allows a locally authenticated malicious user to escalate privileges in Spring Framework WebFlux applications by manipulating temporary storage directories. Attackers can read or modify uploaded files or overwrite arbitrary files with multipart request data. Affects Spring Framework versions 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7.

💻 Affected Systems

Products:

Spring Framework
Applications using Spring WebFlux

Versions: Spring Framework 5.2.x prior to 5.2.15, 5.3.x prior to 5.3.7

Operating Systems: All operating systems running affected Spring versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects applications using Spring WebFlux with multipart file upload functionality. Applications using Spring MVC are not affected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise through file manipulation leading to arbitrary code execution, data theft, or service disruption.

🟠

Likely Case

Unauthorized access to sensitive uploaded files, modification of application data, or denial of service through file corruption.

🟢

If Mitigated

Limited impact with proper file permissions and isolation, but still potential for data leakage within application scope.

🌐 Internet-Facing: MEDIUM - Requires local authentication, but internet-facing applications could be targeted through other initial access vectors.

🏢 Internal Only: HIGH - Local authenticated users can exploit this to escalate privileges and access/modify sensitive files.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local authentication but is straightforward once authenticated. Public proof-of-concept code exists demonstrating the directory manipulation technique.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Spring Framework 5.2.15 or 5.3.7 and later

Vendor Advisory: https://tanzu.vmware.com/security/cve-2021-22118

Restart Required: Yes

Instructions:

1. Update Spring Framework dependency to version 5.2.15 or higher (for 5.2.x) or 5.3.7 or higher (for 5.3.x). 2. Update pom.xml or build.gradle with new version. 3. Rebuild and redeploy application. 4. Restart application server.

🔧 Temporary Workarounds

Disable multipart file uploads

all

If file upload functionality is not required, disable multipart support in WebFlux configuration

spring.servlet.multipart.enabled=false

Use custom temporary directory with strict permissions

linux

Configure WebFlux to use a dedicated temporary directory with restrictive permissions

spring.servlet.multipart.location=/secure/temp/dir
chmod 700 /secure/temp/dir
chown appuser:appgroup /secure/temp/dir

🧯 If You Can't Patch

Implement strict file system permissions on temporary directories to limit access to application user only
Monitor file system activity in temporary directories for unauthorized access or modification attempts

🔍 How to Verify

Check if Vulnerable:

Check Spring Framework version in pom.xml, build.gradle, or application dependencies. Verify if using WebFlux with version 5.2.0-5.2.14 or 5.3.0-5.3.6.

Check Version:

mvn dependency:tree | grep spring-core OR gradle dependencies | grep spring-core

Verify Fix Applied:

Confirm Spring Framework version is 5.2.15+ or 5.3.7+ in dependencies. Test multipart file upload functionality to ensure it works with the patched version.

📡 Detection & Monitoring

Log Indicators:

Unauthorized file access attempts in temporary directories
Multiple failed file operations in WebFlux logs
Suspicious directory creation/modification patterns

Network Indicators:

Unusual multipart request patterns to WebFlux endpoints
Large volume of file upload requests from single source

SIEM Query:

source="*spring*" AND ("multipart" OR "file upload") AND ("permission denied" OR "access denied" OR "directory creation")

📊 Metadata

CVE ID: CVE-2021-22118

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-269

Published: May 27, 2021

Last Updated: November 21, 2024

🔗 References

https://security.netapp.com/advisory/ntap-20210713-0005/ Third Party Advisory
https://tanzu.vmware.com/security/cve-2021-22118 Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://security.netapp.com/advisory/ntap-20210713-0005/ Third Party Advisory
https://tanzu.vmware.com/security/cve-2021-22118 Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Commerce Guided Search by Oracle

Communications Brm Elastic Charging Engine by Oracle

Communications Cloud Native Core Binding Support Function by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Cloud Native Core Security Edge Protection Proxy by Oracle

Communications Cloud Native Core Service Communication Proxy by Oracle

Communications Cloud Native Core Unified Data Repository by Oracle

Communications Diameter Intelligence Hub by Oracle

Communications Diameter Intelligence Hub by Oracle

Communications Element Manager by Oracle

Communications Interactive Session Recorder by Oracle

Communications Network Integrity by Oracle

Communications Session Report Manager by Oracle

Communications Session Route Manager by Oracle

Communications Unified Inventory Management by Oracle

Communications Unified Inventory Management by Oracle

Communications Unified Inventory Management by Oracle

Documaker by Oracle

Enterprise Data Quality by Oracle

Enterprise Data Quality by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Hci by Netapp

Healthcare Data Repository by Oracle

Insurance Policy Administration by Oracle

Insurance Rules Palette by Oracle

Insurance Rules Palette by Oracle

Insurance Rules Palette by Oracle

Insurance Rules Palette by Oracle

Insurance Rules Palette by Oracle

Management Services For Element Software by Netapp

Mysql Enterprise Monitor by Oracle

Retail Assortment Planning by Oracle

Retail Customer Management And Segmentation Foundation by Oracle

Retail Financial Integration by Oracle

Retail Financial Integration by Oracle

Retail Financial Integration by Oracle

Retail Integration Bus by Oracle

Retail Integration Bus by Oracle

Retail Integration Bus by Oracle

Retail Merchandising System by Oracle

Retail Order Broker by Oracle

Retail Predictive Application Server by Oracle

Retail Predictive Application Server by Oracle

Retail Predictive Application Server by Oracle

Spring Framework by Vmware

Spring Framework by Vmware

Utilities Testing Accelerator by Oracle

Utilities Testing Accelerator by Oracle

Utilities Testing Accelerator by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable multipart file uploads

Use custom temporary directory with strict permissions

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities