CVE-2024-22236

Overview

Spring Cloud Contract is an umbrella project within the Spring Cloud ecosystem that helps users implement the Consumer-Driven Contracts (CDC) approach for testing microservices.

An information exposure vulnerability (CVE-2024-22236) has been identified in Spring Cloud Contract where test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions.

This issue affects multiple versions of Spring Cloud Contract.

‍

Details

Module Info

• Product: Spring Cloud Contract
• Affected packages: spring-cloud-contract-shade
• Affected versions: >=3.1.0 <3.1.10, >=4.0.0 <4.0.5, =4.1.0
• GitHub repository: https://github.com/spring-cloud/spring-cloud-contract 
• Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-contract-shade 
• Package manager: Maven
• Fixed in: NES for Spring Cloud Contract

Vulnerability Info

This low-severity vulnerability test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.

‍

Mitigation

Only recent versions of Spring Cloud Contract are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of Spring Framework
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Michael Kimball (Oddball)