Spring Framework (Pfadübersprung) Schwachstelle

An attacker exploiting CVE-2024-38819 can craft malicious HTTP requests to access files outside of the intended static resource directory. This could include configuration files, source code, or other sensitive data stored on the server. The potential impact is significant, as an attacker could gain access to credentials, API keys, or proprietary information. The blast radius extends to any application utilizing Spring Webflux's static resource serving capabilities, particularly those serving user-uploaded content or relying on dynamic file paths. Successful exploitation could lead to data breaches, system compromise, and reputational damage.

Organizations deploying Spring Boot applications that serve static resources using WebMvc.fn or WebFlux.fn are at risk, particularly those running versions of Spring Webflux prior to 6.1.14. Shared hosting environments where multiple applications share the same server and file system are especially vulnerable, as a compromise of one application could potentially expose files belonging to others.

• java / server:

find / -name "spring-webflux*.jar" -exec grep -i "WebMvc.fn" {} \;

• generic web:

curl -I 'http://your-server/../../../../etc/passwd' # Attempt path traversal

1. 2024-12-19Disclosure

   disclosure

1. Reserviert2024-06-19
2. Veröffentlicht2024-12-19
3. Geändert2025-05-28
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-38819 is to upgrade to Spring Webflux version 6.1.14 or later. If immediate upgrading is not feasible, consider implementing stricter file access controls and input validation to limit the attacker's ability to manipulate file paths. Web Application Firewalls (WAFs) configured with rules to block path traversal attempts can provide an additional layer of defense. Review and restrict the permissions granted to the process running the Spring application to minimize the potential impact of a successful exploit. Monitor access logs for suspicious file requests.