CVE-2024-38819: Spring Framework Path Traversal vulnerability

The vulnerability is a path traversal issue due to improper sanitization and validation of user-supplied paths when serving static resources. The patches (3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d and fb7890d73975a3d9e0763e0926df2bd0a608e87e) address this by introducing and refining path normalization logic (new normalizePath and decode methods) and by strengthening validation checks in isInvalidPath methods.

The processPath methods in PathResourceLookupFunction (for WebFlux.fn and WebMvc.fn), ResourceWebHandler (WebFlux), and ResourceHttpRequestHandler (WebMvc) are directly responsible for initial path processing. The patches modify these methods to incorporate the new normalization logic. Therefore, their pre-patch versions, which lacked this normalization, are considered vulnerable as they processed potentially malicious input without adequate sanitization.

Similarly, the isInvalidPath methods in these classes contained insufficient checks to detect and block path traversal attempts (e.g., involving '..', URL-encoded characters). The patches corrected these checks. Thus, their pre-patch versions are also considered part of the vulnerability.

The functions normalizePath and decode are part of the mitigation, not the vulnerability itself. The vulnerability lies in the functions that failed to normalize or validate paths correctly before these fixes were introduced.