CVE-2025-22234: 
Jenkins vulnerability analysis and mitigation

CVE-2025-22234 is a timing attack vulnerability in Spring Security's DaoAuthenticationProvider caused by a regression introduced while fixing CVE-2025-22228. The fix for CVE-2025-22228 (related to BCryptPasswordEncoder maximum password length) inadvertently broke the timing attack mitigation, allowing unauthenticated attackers to infer valid usernames or other authentication behavior via observable response-time differences. Affected versions include Spring Security 5.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8, and 6.4.4, as well as older unsupported versions. The vulnerability was publicly disclosed on April 22, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Spring Advisory, Github Advisory).

The root cause is classified as CWE-208 (Observable Timing Discrepancy). Spring Security's DaoAuthenticationProvider previously implemented a constant-time dummy password check to prevent timing-based user enumeration — when a username does not exist, it still performs a password hash comparison to equalize response times. The patch for CVE-2025-22228 (which addressed BCryptPasswordEncoder's handling of passwords exceeding 72 bytes) inadvertently skipped or short-circuited this dummy check under certain conditions, reintroducing a measurable timing difference between authentication attempts for valid versus invalid usernames. No privileges or user interaction are required to exploit this flaw; an attacker only needs network access to the authentication endpoint (Spring Advisory, Github Advisory).

Successful exploitation allows unauthenticated remote attackers to enumerate valid usernames by measuring and comparing authentication response times. This confidentiality impact is limited — no passwords or session tokens are directly exposed — but valid username lists can significantly accelerate targeted credential stuffing, brute-force, or phishing campaigns. Integrity and availability are not affected by this vulnerability (Spring Advisory, Github Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.022% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only network access and no credentials, making it accessible to low-skilled attackers, though practical exploitation depends on network conditions and the ability to make statistically significant timing measurements (Github Advisory, Spring Advisory).

1. Reconnaissance: Identify Spring Security-based applications using affected versions (5.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8, or 6.4.4) by examining HTTP response headers, error pages, or framework fingerprints.
2. Baseline timing measurement: Send multiple authentication requests with a known-invalid username and record the average response time to establish a baseline for non-existent accounts.
3. Username probing: Send authentication requests with candidate usernames (e.g., from a wordlist of common usernames or harvested email addresses) and measure response times for each.
4. Statistical analysis: Compare response times — usernames that trigger a longer response (due to the actual password hash comparison being performed) indicate valid accounts, while shorter responses indicate non-existent users.
5. Username enumeration: Compile a list of valid usernames for use in subsequent targeted attacks such as credential stuffing or spear phishing (Spring Advisory, Github Advisory).

• Network: High volume of authentication requests from a single IP or small IP range targeting the login endpoint, especially with varied usernames but consistent (often incorrect) passwords.
• Logs: Authentication failure logs showing repeated attempts with many different usernames in rapid succession; statistical clustering of response times may be observable in access logs if timing is recorded.
• Behavioral: Unusual patterns of failed logins where the attacker systematically cycles through username lists without apparent brute-forcing of passwords, suggesting enumeration rather than credential stuffing.

Spring has released patched versions addressing this regression. Users should upgrade to the corresponding fixed version as soon as possible:

• 5.7.16 → 5.7.17 (Enterprise Support only)
• 5.8.18 → 5.8.19 (Enterprise Support only)
• 6.0.16 → 6.0.17 (Enterprise Support only)
• 6.1.14 → 6.1.15 (Enterprise Support only)
• 6.2.10 → 6.2.11 (Enterprise Support only)
• 6.3.8 → 6.3.9 (OSS)
• 6.4.4 → 6.4.5 (OSS)

As interim mitigations, implement rate limiting and account lockout on authentication endpoints to reduce the practical effectiveness of timing-based enumeration. Adding network-level controls such as a WAF or reverse proxy with request throttling can further reduce exposure (Spring Advisory).

The vulnerability received moderate community attention following the Spring advisory published on April 22, 2025. Discussions appeared on Reddit's r/netsec and r/java communities, with developers noting the irony of a security fix introducing a new vulnerability. Security news outlets including GBHackers, CyberSecurityNews, and CyberPress covered the disclosure. The issue was responsibly reported by Jonas Robl and credited in the official Spring advisory. The InfoQ Spring news roundup also highlighted the release of patched versions (Spring Advisory, Github Advisory).