Vulnérabilité de parcours de chemin dans Spring Framework

The core of this vulnerability lies in how Spring Webflux handles static resource requests through its functional web frameworks, WebMvc.fn and WebFlux.fn. An attacker can exploit this by manipulating the request path to bypass intended access controls. This allows them to read arbitrary files accessible to the Spring application's process, potentially including configuration files, source code, or even sensitive data like database credentials. The blast radius is significant, as successful exploitation could lead to complete compromise of the server and its data. While no direct precedent is immediately obvious, the underlying mechanism shares similarities with other path traversal vulnerabilities where improper input validation allows access to unauthorized resources.

Organizations deploying Spring Boot applications that serve static resources using WebMvc.fn or WebFlux.fn are at risk, particularly those running versions of Spring Webflux prior to 6.1.14. Shared hosting environments where multiple applications share the same server and file system are especially vulnerable, as a compromise of one application could potentially expose files belonging to others.

• java / server:

find / -name "spring-webflux*.jar" -exec grep -i "WebMvc.fn" {} \;

• generic web:

curl -I 'http://your-server/../../../../etc/passwd' # Attempt path traversal

1. 2024-12-19Disclosure

   disclosure

1. Réservé2024-06-19
2. Publiée2024-12-19
3. Modifiée2025-05-28
4. EPSS mis à jour2026-04-02

The primary mitigation is to upgrade to Spring Webflux version 6.1.14 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) or reverse proxy with rules to filter out malicious path traversal attempts. Specifically, look for patterns involving directory traversal sequences like ../ or encoded equivalents. Additionally, review your application's static resource configuration to ensure that access controls are properly enforced and that only authorized files are served. After upgrading, verify the fix by attempting to access a file outside the intended static resource directory using a crafted HTTP request; the request should be denied.