Spring Framework Path Traversal in Functional Web Frameworks
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. The application is vulnerable when it uses RouterFunctions to serve static resources and resource handling is explicitly configured with a FileSystemResource location. This is similar to CVE-2024-38816, but with different input. Unlike CVE-2024-38816, applications deployed on Tomcat or Jetty are also vulnerable. References: https://spring.io/security/cve-2024-38819 https://nvd.nist.gov/vuln/detail/CVE-2024-38819 https://github.com/masa42/CVE-2024-38819-PoC Remediation: Implement input validation and sanitize file paths, or update to the latest version of Spring Framework.
Used 20 times · 10 assets checked · domain, subdomain, ipv4