Detailed Exploration of CVE-2024-38816
Vulnerability Info
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring® application is running.
Specifically, an application is vulnerable when both of the following are true:
- the web application uses RouterFunctions to serve static resources
- resource handling is explicitly configured with a FileSystemResource location
However, malicious requests are blocked and rejected when any of the following is true:
Why Is This a Problem?
- Bypasses Static Resource Protection
In apps using RouterFunctions and serving files from the filesystem (e.g., with FileSystemResource), attackers can request paths like:
/public/../../../../etc/passwd
…to read sensitive files.
- Exposes Sensitive Information
- Attackers can read files like:
- /etc/passwd (user info)
- Configuration files with credentials
- Source code, logs, or private keys
- Can Lead to Further Exploits
- Leaked information may help attackers:
- Escalate privileges
- Perform local file inclusion (LFI)
- Mount further attacks (e.g., SSRF, RCE)
- Works in Reactive and Traditional Apps
Affects both Spring® WebFlux.fn and Spring® WebMvc.fn applications, making it relevant across different web stacks.
Steps to Reproduce
If you configure your Spring® WebFlux or WebMvc.fn app to serve files from the local filesystem (e.g. /var/www/files) using RouterFunctions, an attacker can craft URLs like:
/files/../../../etc/passwd
…to access arbitrary files outside the allowed directory.
Prerequisites
- Use Spring® Framework versions:
- 5.3.0 – 5.3.39
- 6.0.0 – 6.0.23
- 6.1.0 – 6.1.12
- Web stack: Spring® WebFlux.fn or Spring® WebMvc.fn
Serve static files using FileSystemResource with no extra security constraints.
Example Code to Reproduce (Spring® Boot + WebFlux)
pom.xml (for Maven)
Use Spring® Boot 2.7.17 (which includes Spring® Framework 5.3.39 – vulnerable)
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-webflux</artifactId>
<version>2.7.17</version>
</dependency>
2. File Structure
/static-files/
└── hello.txt
3. Application Code
@Configuration
public class StaticResourceRouter {
@Bean
public RouterFunction<ServerResponse> staticFiles() {
return RouterFunctions
.resources(“/files/**”, new FileSystemResource(“/absolute/path/to/static-files”));
}
}
Test It
🟢 Normal Request:
GET http://localhost:8080/files/hello.txt
✅ Responds with the file.
🔴 Path Traversal Exploit:
GET http://localhost:8080/files/../../../etc/passwd
or URL-encoded:
GET http://localhost:8080/files/..%2F..%2F..%2Fetc%2Fpasswd
❗ Expected (Vulnerable App):
Returns content of /etc/passwd (or other accessible files outside /static-files).
Mitigation
Spring® Framework 5.3.x is no longer supported by the open source community, as its End of Life date is 2023-06-30. It simply means that the version from that date does not receive any updates to address this issue.
Users of the affected components should apply one of the following mitigations:
- Leverage TuxCare’s Endless Lifecycle Support, which extends regular community end-of-life security support, then simply just apply our patches.
- Upgrade to the 6.1.13+ open source community version and accept the risk of not getting any further security updates from the community starting from 30th of June’25.
- Alternatively, take the effort to upgrade to the latest greatest still 1 year + supported Spring® Framework open source versions that are not affected e.g. 6.2.5
- Replace FileSystemResource with ClassPathResource (prevents file system access).
- Use Spring® Security HTTP Firewall to reject suspicious path traversal patterns.
Do you need a fix for this vulnerability for any other Spring® Framework version? Please contact us, we are here to help you!
Tech Support
Documentation
Login
Contact Us
