VMware Spring Framework < 5.3.40, 6.0.x < 6.0.24, 6.1.x < 6.1.13 Path Traversal Vulnerability - Windows

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:vmware:spring_framework";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.153170");
  script_version("2025-09-04T05:39:49+0000");
  script_tag(name:"last_modification", value:"2025-09-04 05:39:49 +0000 (Thu, 04 Sep 2025)");
  script_tag(name:"creation_date", value:"2024-09-24 03:35:43 +0000 (Tue, 24 Sep 2024)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:N/A:N");

  script_cve_id("CVE-2024-38816");

  script_tag(name:"qod_type", value:"executable_version");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("VMware Spring Framework < 5.3.40, 6.0.x < 6.0.24, 6.1.x < 6.1.13 Path Traversal Vulnerability - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_vmware_spring_framework_consolidation.nasl");
  script_mandatory_keys("vmware/spring/framework/smb-login/detected");

  script_tag(name:"summary", value:"The VMware Spring Framework is prone to a path traversal
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Applications serving static resources through the functional
  web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can
  craft malicious HTTP requests and obtain any file on the file system that is also accessible to
  the process in which the Spring application is running.

  Specifically, an application is vulnerable when both of the following are true:

  - the web application uses RouterFunctions to serve static resources

  - resource handling is explicitly configured with a FileSystemResource location

  However, malicious requests are blocked and rejected when any of the following is true:

  - the Spring Security HTTP Firewall is in use

  - the application runs on Tomcat or Jetty");

  script_tag(name:"affected", value:"VMware Spring Framework versions prior to 5.3.40, 6.0.x prior
  to 6.0.24 and 6.1.x prior to 6.1.13.");

  script_tag(name:"solution", value:"Update to version 5.3.40, 6.0.24, 6.1.13 or later.

  Vendor note:

  Users of older, unsupported versions could enable Spring Security's Firewall in their
  application, or switch to using Tomcat or Jetty as a Web server because they reject such
  malicious requests.");

  script_xref(name:"URL", value:"https://spring.io/security/cve-2024-38816");
  script_xref(name:"URL", value:"https://spring.io/blog/2024/09/12/spring-framework-releases-fixes-for-cve-2024-38816");
  script_xref(name:"URL", value:"https://web.archive.org/web/20240925112009/https://github.com/masa42/CVE-2024-38816-POC");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "5.3.40")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "5.3.40", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "6.0.0", test_version_up: "6.0.24")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "6.0.24", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "6.1.0", test_version_up: "6.1.13")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "6.1.13", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);