CVE-2022-27772
📋 TL;DR
Spring Boot versions before 2.2.11.RELEASE are vulnerable to temporary directory hijacking in the createTempDir method. This allows attackers to manipulate temporary directories used by the application, potentially leading to arbitrary file writes or code execution. Only unsupported versions are affected.
💻 Affected Systems
- Spring Boot
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could write arbitrary files to the system, potentially leading to remote code execution, privilege escalation, or complete system compromise.
Likely Case
Local attackers could manipulate temporary files to influence application behavior, potentially leading to data corruption or limited code execution.
If Mitigated
With proper file permissions and isolation, impact is limited to the application's own temporary directory scope.
🎯 Exploit Status
Exploitation requires local access or ability to manipulate temporary directory creation. Public advisory includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.11.RELEASE
Vendor Advisory: https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-cm59-pr5q-cw85
Restart Required: Yes
Instructions:
1. Upgrade Spring Boot to version 2.2.11.RELEASE or later. 2. Update dependencies in pom.xml or build.gradle. 3. Rebuild and redeploy application. 4. Restart affected services.
🔧 Temporary Workarounds
Set custom temp directory
allConfigure Spring Boot to use a secure, dedicated temporary directory with proper permissions
java -Djava.io.tmpdir=/secure/temp/dir -jar application.jar
Use container isolation
linuxRun application in container with restricted filesystem access
docker run --read-only -v /tmp:/tmp:ro your-application
🧯 If You Can't Patch
- Implement strict file permissions on temporary directories (chmod 700)
- Run application with minimal privileges and filesystem isolation
🔍 How to Verify
Check if Vulnerable:
Check Spring Boot version in pom.xml, build.gradle, or via 'java -jar application.jar --version'Check Version:
grep -i 'spring-boot' pom.xml | grep versionVerify Fix Applied:
Verify version is 2.2.11.RELEASE or later and test temporary directory creation📡 Detection & Monitoring
Log Indicators:
- Unauthorized file creation in temp directories
- Unexpected process execution from temp locations
Network Indicators:
- None - local vulnerability
SIEM Query:
source="*spring-boot*" AND (event="file_create" OR event="process_exec") AND path="*/tmp/*"