Описание
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true:
- the web application uses RouterFunctions to serve static resources
- resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true:
- the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html is in use
- the application runs on Tomcat or Jetty
A flaw was found in Spring applications using the WebMvc.fn or WebFlux.fn frameworks. This issue can allow attackers to perform path traversal attacks via crafted HTTP requests when the application serves static resources using RouterFunctions and explicitly configures resource handling with a FileSystemResource location.
Отчет
Path traversal vulnerabilities in applications that serve static resources via RouterFunctions and FileSystemResource pose a important security risk, as they allow attackers to bypass access controls and retrieve arbitrary files from the server's filesystem. This type of attack can lead to unauthorized exposure of sensitive data, such as configuration files, environment variables, or authentication credentials. If exploited, it can further facilitate privilege escalation, lateral movement, or remote code execution within the system. Given the broad access it grants to the server's filesystem, the potential for system compromise makes path traversal vulnerabilities a high-severity issue.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | org.springframework/spring-webmvc | Will not fix | ||
| Red Hat AMQ Broker 7 | org.springframework/spring-webmvc | Will not fix | ||
| Red Hat build of Apache Camel for Spring Boot 3 | org.springframework/spring-webmvc | Will not fix | ||
| Red Hat build of Apache Camel - HawtIO 4 | org.springframework/spring-webmvc | Affected | ||
| Red Hat Build of Keycloak | org.springframework/spring-webmvc | Not affected | ||
| Red Hat build of OptaPlanner 8 | org.springframework/spring-webmvc | Will not fix | ||
| Red Hat build of Quarkus | org.springframework/spring-webmvc | Not affected | ||
| Red Hat Data Grid 8 | org.springframework/spring-webmvc | Not affected | ||
| Red Hat Fuse 7 | org.springframework/spring-webmvc | Will not fix | ||
| Red Hat Integration Camel K 1 | org.springframework/spring-webmvc | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: * the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true: * the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html is in use * the application runs on Tomcat or Jetty
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: * the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true: * the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html is in use * the application runs on Tomcat or Jetty
Applications serving static resources through the functional web frame ...
Path traversal vulnerability in functional web frameworks
Уязвимость функциональных веб-фреймворков WebMvc.fn и WebFlux.fn программной платформы Spring Framework, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю получить доступ к произвольному файлу в файловой системе
EPSS
7.5 High
CVSS3