7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-34062

CVE-2023-34062: In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.

Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-34062

CVE-2023-34062:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.projectreactor.netty:reactor-netty-http	maven	>= 1.1.0, < 1.1.13	1.1.13
io.projectreactor.netty:reactor-netty-http	maven	>= 1.0.0, < 1.0.39	1.0.39

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2023-34062) is a directory traversal attack in Reactor Netty HTTP Server when serving static resources. The provided commit b1dd46b9a424ca27f7f770be6561faa84d812e5b, consistently referenced by advisories (NVD, Spring, GitHub Advisory) as the fix, primarily contains code style changes (reordering 'static final' modifiers) and a substantive change in reactor.netty.http.client.UriEndpointFactory.java. This change involves adding strict validation for URL schemes (http, https, ws, wss) to the createUriEndpoint methods, which are part of a client-side utility.

For this client-side focused commit to address the described server-side directory traversal, it is inferred that the server's static resource handling mechanism was, prior to the patch, improperly using these createUriEndpoint methods from UriEndpointFactory to parse or process request URLs (or URLs derived from them). The lack of scheme validation in these methods would have allowed a URL with a specially crafted scheme (e.g., 'file:') to be processed. If the server then unsafely used the scheme and path from the UriEndpoint object returned by these methods to access the file system, it could lead to directory traversal.

The identified vulnerable functions are the two createUriEndpoint methods in UriEndpointFactory because they processed the potentially malicious URL input without the necessary scheme validation, which, under the assumption of misuse by server code, contributed to the server-side vulnerability. The confidence is 'medium' because the exact mechanism of server-side misuse of these client utilities is not detailed within this specific patch but is inferred from the CVE description and the nature of the fix in the provided commit. Other changes in the commit were stylistic and not related to the vulnerability's logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.