How to Patch Critical Spring & Nacos Vulnerabilities in 2024

Overview

Spring Framework and Nacos have each published security advisories for critical vulnerabilities that can lead to denial‑of‑service (DoS) attacks or arbitrary file read/write on the server.

CVE-2024-38808 – Spring Framework SpEL DoS

Versions 5.3.0 – 5.3.38 (including earlier unsupported releases) allow a crafted Spring Expression Language (SpEL) payload to consume excessive CPU and cause a DoS condition when evaluated.

Affected versions: 5.3.0 – 5.3.38

Fixed version: 5.3.39

Mitigation: Upgrade to Spring Framework 5.3.39 or later. When expression evaluation is required, use SimpleEvaluationContext in read‑only mode, e.g. SimpleEvaluationContext.forReadOnlyDataBinding().

Patch for Spring Boot 2.x Projects

1. Add the following dependencyManagement entry to pom.xml:

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-framework-bom</artifactId>
            <version>5.3.39</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

2. Review all SpEL usage (custom annotations, rate‑limit logic, permission checks, caching, etc.) and ensure that user‑supplied input is never evaluated, or replace the evaluation with a read‑only SimpleEvaluationContext.

CVE-2024-38809 – Spring Framework ETag Parsing DoS

When parsing the If-Match or If-None-Match request headers, Spring may be vulnerable to DoS attacks via crafted ETag values.

Affected versions: 6.1.0‑6.1.11, 6.0.0‑6.0.22, 5.3.0‑5.3.37

Fixed versions: 6.1.12, 6.0.23, 5.3.38

Mitigation: Upgrade to the patched releases. If upgrading is not possible, limit the maximum size of incoming HTTP headers (e.g., configure server.max-http-header-size in Spring Boot).

Nacos Jraft Port File‑Read/Write Vulnerability

On 2024‑08‑15 the Nacos community disclosed a critical issue in the default Jraft port (7848). The port allowed arbitrary file read/write because file‑path handling was not validated during disk operations.

Fixed versions: Nacos 2.4.1 and 1.4.8

Mitigation: Upgrade to the fixed Nacos releases. Keep the Jraft port closed to external networks; if an immediate upgrade is impossible, block external traffic to port 7848 with firewall rules.

Recommendations

Apply the indicated upgrades as soon as possible, monitor official security bulletins, and regularly audit configuration and third‑party dependencies to maintain system stability and data confidentiality.