7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-38816

CVE-2024-38816: Path traversal vulnerability in functional web frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Specifically, an application is vulnerable when both of the following are true:

the web application uses RouterFunctions to serve static resources
resource handling is explicitly configured with a FileSystemResource location

However, malicious requests are blocked and rejected when any of the following is true:

the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html is in use
the application runs on Tomcat or Jetty

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-38816

CVE-2024-38816:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework:spring-webmvc	maven	>= 6.1.0, < 6.1.13	6.1.13
org.springframework:spring-webflux	maven	>= 6.1.0, < 6.1.13	6.1.13
org.springframework:spring-webmvc	maven	>= 6.0.0, <= 6.0.23
org.springframework:spring-webflux	maven	>= 6.0.0, <= 6.0.23
org.springframework:spring-webmvc	maven	>= 5.3.0, <= 5.3.39
org.springframework:spring-webflux	maven	>= 5.3.0, <= 5.3.39

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in Spring Framework's functional web routing for static resources. The provided commit d86bf8b2056429edf5494456cffcb2b243331c49 patches PathResourceLookupFunction.java in both spring-webflux and spring-webmvc modules. The core changes are within the apply(ServerRequest) methods of these classes. These methods are responsible for taking a path from an HTTP request, processing it, and then using it to create a Resource object, typically by calling location.createRelative(path). The patches introduce more robust path sanitization and validation steps, including new helper methods like isInvalidEncodedInputPath, isInvalidEncodedResourcePath, cleanDuplicateSlashes, and cleanLeadingSlash, and modify existing checks within apply, processPath, and isResourceUnderLocation. This clearly indicates that the previous versions of the apply methods, along with their helper functions, did not sufficiently sanitize user-provided paths, allowing specially crafted inputs (e.g., with URL-encoded ../ sequences) to traverse the filesystem. Therefore, the apply methods are identified as the primary vulnerable functions as they orchestrate the processing of the user-controlled path and its use in accessing file system resources.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.