Spring Framework SSRF & RCE via XsltView

Use of XsltView in a Spring MVC application can lead to Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) attacks.

This occurs when the application has an /** mapping that results in view rendering, and the view name is not explicitly specified.

Versions affected:

• Spring Framework 7.0.0 - 7.0.8
• Spring Framework 6.2.0 - 6.2.19
• Spring Framework 6.1.0 - 6.1.28
• Spring Framework 6.0.0 - 6.0.30
• Spring Framework 5.3.0 - 5.3.49
• Spring Framework 5.2.25.RELEASE and earlier