Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-23673

CVE-2024-23673:
Apache Sling Servlets Resolver executes malicious code via path traversal

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-23673
GHSA ID
GHSA-h2rq-qhr7-53gm
EPSS Score
0.35707%
CWE
CWE-22
Published
2/6/2024
Updated
2/13/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.sling:org.apache.sling.servlets.resolvermaven< 2.11.02.11.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing path validation in script resolution logic. The patch introduced the isInvalidPath() check to reject paths with >2 consecutive dots. The findScript method (SlingScriptResolverImpl) and resolveServletInternal method (SlingServletResolver) were both processing unvalidated user-controlled paths, making them entry points for path traversal. The commit diff shows these methods were modified to add validation, confirming they were previously vulnerable.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

M*li*ious *o** *x**ution vi* p*t* tr*v*rs*l in *p**** So*tw*r* *oun**tion *p**** Slin* S*rvl*ts R*solv*r.T*is issu* *****ts *ll v*rsion o* *p**** Slin* S*rvl*ts R*solv*r ***or* *.**.*. *ow*v*r, w**t**r * syst*m is vuln*r**l* to t*is *tt**k **p*n*s on

Reasoning

T** vuln*r**ility st*ms *rom missin* p*t* v*li**tion in s*ript r*solution lo*i*. T** p*t** intro*u*** t** `isInv*li*P*t*()` ****k to r*j**t p*t*s wit* >* *ons**utiv* *ots. T** `*in*S*ript` m*t*o* (Slin*S*riptR*solv*rImpl) *n* `r*solv*S*rvl*tInt*rn*l`