CVE-2023-34055: VMware Spring Boot DoS Vulnerability

CVE-2023-34055 Overview

CVE-2023-34055 is a Denial of Service (DoS) vulnerability affecting VMware Spring Boot applications that utilize Spring MVC or Spring WebFlux with the Spring Boot Actuator on the classpath. An authenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests to vulnerable endpoints, potentially causing service disruption and application unavailability.

The vulnerability specifically impacts applications meeting all of the following conditions: the application uses Spring MVC or Spring WebFlux, and the org.springframework.boot:spring-boot-actuator dependency is present on the classpath. This combination creates an attack surface that allows malicious actors to exhaust server resources through carefully constructed requests.

Critical Impact

Authenticated attackers can cause complete application unavailability through specially crafted HTTP requests, potentially disrupting business-critical services and operations.

Affected Products

• VMware Spring Boot versions 2.7.0 through 2.7.17
• VMware Spring Boot versions 3.0.0 through 3.0.12
• VMware Spring Boot versions 3.1.0 through 3.1.5

Discovery Timeline

• 2023-11-28 - CVE-2023-34055 published to NVD
• 2025-02-13 - Last updated in NVD database

Technical Details for CVE-2023-34055

Vulnerability Analysis

This vulnerability allows an authenticated user to trigger a Denial of Service condition in Spring Boot applications. The attack targets applications that have both Spring MVC or Spring WebFlux enabled and include the Spring Boot Actuator dependency. When these conditions are met, the application becomes susceptible to resource exhaustion through malformed HTTP requests.

The vulnerability is network-accessible and requires low attack complexity, though authentication is required. While the vulnerability does not impact confidentiality or integrity, it can completely compromise system availability. The unchanged scope indicates the impact is limited to the vulnerable component itself.

Root Cause

The root cause stems from improper handling of specially crafted HTTP requests in Spring Boot applications when the Actuator endpoints are exposed. The Actuator provides various endpoints for monitoring and managing applications, and when combined with Spring MVC or Spring WebFlux, certain request patterns can trigger resource exhaustion conditions that lead to service unavailability.

Attack Vector

The attack vector is network-based, requiring authenticated access to the vulnerable application. An attacker with valid credentials can craft malicious HTTP requests targeting the application's endpoints. When the application processes these requests, it may enter a state where resources are consumed excessively, leading to degraded performance or complete service denial.

The exploitation requires:

1. Network access to the target Spring Boot application
2. Valid authentication credentials
3. The target application must use Spring MVC or Spring WebFlux
4. The spring-boot-actuator dependency must be on the classpath

The attacker sends carefully constructed HTTP requests that exploit the request handling mechanism, causing the application to consume excessive resources during processing. This can manifest as memory exhaustion, thread pool starvation, or other resource depletion scenarios that prevent legitimate users from accessing the application.

Detection Methods for CVE-2023-34055

Indicators of Compromise

• Unusual patterns of HTTP requests targeting actuator endpoints such as /actuator/health, /actuator/info, or custom actuator paths
• Sudden spikes in memory consumption or CPU utilization on Spring Boot application servers
• Increased thread pool exhaustion warnings in application logs
• Abnormal response times or timeout errors from Spring Boot services

Detection Strategies

• Monitor application logs for repeated requests from single sources with unusual request patterns
• Implement rate limiting on actuator endpoints and track violation events
• Configure application performance monitoring (APM) tools to alert on resource consumption anomalies
• Deploy web application firewall (WAF) rules to detect and block malformed HTTP request patterns

Monitoring Recommendations

• Enable detailed access logging for all actuator endpoints
• Set up alerts for abnormal memory and CPU utilization patterns in Spring Boot applications
• Monitor thread pool metrics and establish baselines for normal operation
• Implement centralized log aggregation to correlate suspicious activity across multiple application instances

How to Mitigate CVE-2023-34055

Immediate Actions Required

• Upgrade Spring Boot to patched versions: 2.7.18+, 3.0.13+, or 3.1.6+ immediately
• Restrict access to actuator endpoints using Spring Security configurations
• Implement rate limiting on all exposed actuator endpoints
• Review and minimize exposed actuator endpoints to only those required for operations

Patch Information

VMware has released security updates to address this vulnerability. Organizations should upgrade to the following patched versions:

• Spring Boot 2.7.x: Upgrade to version 2.7.18 or later
• Spring Boot 3.0.x: Upgrade to version 3.0.13 or later
• Spring Boot 3.1.x: Upgrade to version 3.1.6 or later

Detailed patch information and upgrade guidance is available in the Spring Security Advisory for CVE-2023-34055. Additional security information is available in the NetApp Security Advisory.

Workarounds

• Disable non-essential actuator endpoints by configuring management.endpoints.enabled-by-default=false
• Place actuator endpoints behind authentication using Spring Security
• Deploy a reverse proxy or WAF to filter malicious requests before they reach the application
• Consider network segmentation to limit exposure of management endpoints to internal networks only

# Configuration example for application.properties
# Disable all actuator endpoints by default
management.endpoints.enabled-by-default=false

# Enable only required endpoints explicitly
management.endpoint.health.enabled=true
management.endpoint.info.enabled=true

# Restrict actuator endpoint exposure
management.endpoints.web.exposure.include=health,info

# Change actuator base path (security through obscurity - use with other controls)
management.endpoints.web.base-path=/internal-management

# Require authentication for actuator endpoints (configure Spring Security separately)
management.endpoint.health.show-details=when-authorized