Vulnerability in org.springframework.boot:spring-boot (CVE-2022-27772)

Summary

Vulnerability in org.springframework.boot:spring-boot (CVE-2022-27772). Successful exploitation can lead to full system takeover. Exploitable via File.mkdir. Mitigation: upgrade to 2.2.11.RELEASE or later.

Original description

The description as published by the source.

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method.

The vulnerable method is used to create a work directory for embedded web servers such as Tomcat and Jetty. The directory contains configuration files, JSP/class files, etc. If a local attacker got the permission to write in this directory, they could completely take over the application (ie. local privilege escalation).

Impact Location

This vulnerability impacted the following source location:

	/**
	 * Return the absolute temp dir for given web server.
	 * @param prefix server name
	 * @return the temp dir for given server.
	 */
	protected final File createTempDir(String prefix) {
		try {
			File tempDir = File.createTempFile(prefix + ".", "." + getPort());
			tempDir.delete();
			tempDir.mkdir();
			tempDir.deleteOnExit();
			return tempDir;
		}

- https://github.com/spring-projects/spring-boot/blob/ce70e7d768977242a8ea6f93188388f273be5851/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/AbstractConfigurableWebServerFactory.java#L165-L177

This vulnerability exists because File.mkdir returns false when it fails to create a directory, it does not throw an exception. As such, the following race condition exists:

File tmpDir =File.createTempFile(prefix + ".", "." + getPort()); // A…

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2022-27772 has been found in org.springframework.boot:spring-boot.
Attackers can target a specific entry point like File.mkdir over the network to misuse the product.
Successful exploitation can lead to full system takeover.
What to do: upgrade org.springframework.boot:spring-boot to 2.2.11.RELEASE or later.
If unsure, ask your IT team or search "org.springframework.boot:spring-boot CVE-2022-27772" on the vendor's site.

CVE-2022-27772 (org.springframework.boot:spring-boot) — CWE-377
Attack vector: local / no user interaction
Attack surface: File.mkdir / false / java.io.tmpdir
Patched: 2.2.11.RELEASE — apply immediately
Workaround: Setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-377) exists in org.springframework.boot:spring-boot. Attackers reach the vulnerable code path via File.mkdir.

📍 Affected scope

Check the vendor advisory for the affected versions of org.springframework.boot:spring-boot. Attack surface: File.mkdir / false / java.io.tmpdir.

🔥 Severity

Severity: ?. Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to 2.2.11.RELEASE.

🛡️ Workaround

Workaround: Setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
資産台帳・SBOM・依存マニフェストで org.springframework.boot:spring-boot を使っているサービスとバージョンを洗い出す。
2
Apply temporary workaround mitigate
```
Setting the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.
```
パッチが適用されるまでの応急処置として、Setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems. を実施。回避策の副作用 (機能低下) を確認した上で。
3
Apply patch patch
```
Upgrade org.springframework.boot:spring-boot to 2.2.11.RELEASE
```
ステージング環境で 2.2.11.RELEASE に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
4
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Maven org.springframework.boot:spring-boot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11.RELEASE"}]}]

References

advisory nvd.nist.gov
package github.com
web github.com
web github.com