CVE-2025-0704: Joeybling Bootplus DoS Vulnerability

CVE-2025-0704 Overview

CVE-2025-0704 is a resource consumption vulnerability in JoeyBling bootplus up to commit 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. The flaw resides in the qrCode function of src/main/java/io/github/controller/QrCodeController.java. Attackers can manipulate the w and h (width and height) parameters to trigger uncontrolled resource consumption [CWE-400]. The attack is remotely exploitable without authentication or user interaction. The exploit has been publicly disclosed. Because bootplus uses a rolling release model, no discrete affected or fixed version numbers are published.

Critical Impact
Remote unauthenticated attackers can degrade service availability by requesting oversized QR code generation.

Affected Products

JoeyBling bootplus (rolling release)
Component: QrCodeController.java
Vulnerable commit range: up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d

Discovery Timeline

2025-01-24 - CVE-2025-0704 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0704

Vulnerability Analysis

The vulnerability exists in the QR code generation endpoint exposed by QrCodeController.java in bootplus. The qrCode function accepts client-supplied w (width) and h (height) parameters and passes them into image generation without adequate upper-bound validation. An attacker can submit large numeric values for these parameters and force the server to allocate disproportionate amounts of memory and CPU to render the resulting image.

Repeated requests amplify the effect, exhausting server resources and degrading availability for legitimate users. The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption.

Root Cause

The root cause is missing input validation on the w and h query parameters. The controller trusts client-supplied dimensions and forwards them to the underlying QR code image encoder. Without a sanity check on maximum size, a single malformed request can trigger allocation of very large bitmap buffers.

Attack Vector

Exploitation requires only network access to the vulnerable HTTP endpoint. No authentication, privileges, or user interaction are needed. An attacker issues an HTTP GET or POST request to the QR code generation route with abnormally large w and h values. See the GitHub Issue Discussion and VulDB #293232 for public technical details.

Detection Methods for CVE-2025-0704

Indicators of Compromise

HTTP requests to QR code endpoints containing unusually large w or h query parameters
Sustained spikes in JVM heap usage or garbage collection activity on the bootplus application
Repeated requests to the QR code route from a single source IP within a short window
Application timeouts or OutOfMemoryError events in bootplus logs

Detection Strategies

Inspect web server and application access logs for QR code endpoint requests with dimension parameters exceeding expected ranges
Correlate CPU and memory saturation events with concurrent traffic to QrCodeController routes
Deploy Web Application Firewall (WAF) rules to flag or block requests where w or h exceed a defined maximum

Monitoring Recommendations

Alert on JVM memory pressure and thread pool exhaustion on bootplus hosts
Monitor request rate and payload size distribution for the QR code endpoint
Track HTTP 5xx error rates for bootplus services to detect degradation patterns

How to Mitigate CVE-2025-0704

Immediate Actions Required

Update bootplus to the latest commit that enforces bounds checking on QR code dimensions
Add server-side validation to reject any w or h value above a safe threshold, such as 1024 pixels
Apply rate limiting on the QR code generation endpoint per source IP and per authenticated user
Review application logs for prior exploitation attempts against the QR code route

Patch Information

JoeyBling bootplus uses a rolling release model, so no versioned patch is available. Track upstream fixes through the GitHub Issue Discussion and pull latest commits addressing the QR code parameter validation. Review the VulDB #293232 CI Report for additional remediation context.

Workarounds

Enforce hard maximum values for w and h in a reverse proxy or WAF in front of bootplus
Restrict the QR code endpoint to authenticated users only, if business logic allows
Set JVM memory limits and per-request timeouts to contain the blast radius of abusive requests
Temporarily disable the QR code generation feature if it is not required

bash

# Example nginx rule to bound QR code parameters and rate limit the endpoint
limit_req_zone $binary_remote_addr zone=qrcode:10m rate=5r/s;

location /qrCode {
    limit_req zone=qrcode burst=10 nodelay;
    if ($arg_w ~* "^[0-9]{4,}$") { return 400; }
    if ($arg_h ~* "^[0-9]{4,}$") { return 400; }
    proxy_pass http://bootplus_backend;
}