CVE-2024-38819

CNA: VMware
Severity: High
Creation date: 17th October 2024
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
Affects: Spring^® Framework versions: all versions below 6.1.14,, excluding 5.3.39.tuxcare.3
CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

This CVE has been resolved by the TuxCare team and
a patch has been delivered to ELS for Spring^® users.

Discover ELS for Spring^®

Overview
Detailed Exploration of CVE-2024-38819
Why Is This a Problem?
Steps To Reproduce
Expected Result (Vulnerable)
Mitigation
References

Follow Us On Social

Overview

Spring^® Framework is a comprehensive, open-source framework for building Java applications. It provides dependency injection (DI), aspect-oriented programming (AOP), and transaction management, making Java development more modular and efficient.

Spring^® Web is a module of the Spring^® Framework designed for building web applications and RESTful services in Java. It provides essential web functionalities, including servlet-based request handling, REST API support, and integration with Spring^® Web MVC which is a module within Spring^® Framework that provides a powerful Model-View-Controller (MVC) architecture for building web applications. Spring^® WebFlux is a reactive, non-blocking web framework introduced in Spring^® 5. It is designed for handling asynchronous and event-driven web applications using Project Reactor (reactive streams).

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) takes place when the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2024-38819, a high-severity Path Traversal vulnerability, affects applications that use the WebMvc.fn or WebFlux.fn functional web frameworks to serve static resources. Attackers can exploit this vulnerability by crafting malicious HTTP requests that allow them to retrieve any file on the file system that the Spring^® application process can access.

This issue affects multiple versions of:

org.springframework:spring-webflux
package,

org.springframework:spring-webmvc
package.

Vulnerability Dossier
CVE ID	CVE-2024-38819
Severity	High: 7.5
CWE-ID and name	CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
Affected project	Spring^® Framework
Affected packages	spring-webflux spring-webmvc
Affected versions	All prior 5.3.0, <5.3.0;5.3.40>,<6.0.0;6.0.24>,<6.1.0;6.1.13>
NVD Published date	19th of December 2024 (Spring.io: 17th of October 2024)
TuxCare fix date	19th of March 2025
TuxCare fixed version	5.3.39.tuxcare.3

Detailed Exploration of CVE-2024-38819

Affected product: Spring^® Framework
Affected packages:
- spring-webflux
- spring-webmvc
Affected versions:
- All prior 5.3.0
- 5.3.0 – 5.3.40
- 6.0.0 – 6.0.24
- 6.1.0 – 6.1.13
GitHub repository: https://github.com/spring-projects/spring-framework
Published packages:

https://mvnrepository.com/artifact/org.springframework/spring-webflux

https://mvnrepository.com/artifact/org.springframework/spring-webmvc

Fixed In: ELS for Spring^® Framework:spring-web v5.3.39.TuxCare.3 which relies on the last open source community version 5.3.39 as a baseline, where all TuxCare patches were applied.

In applications where:

Static resources are served using RouterFunctions
Resource handling is explicitly configured with a FileSystemResource location.

An attacker can craft malicious HTTP requests to perform path traversal attacks, potentially accessing any file on the server’s file system that the application process has permission to read.

Why Is This a Problem?

Bypasses Static Resource Protection

In apps using RouterFunctions and serving files from the filesystem (e.g., with FileSystemResource), attackers can request paths like:

/public/../../../../etc/passwd

…to read sensitive files.

Exposes Sensitive Information
- Attackers can read files like:
  - /etc/passwd (user info)
  - Configuration files with credentials
  - Source code, logs, or private keys
Can Lead to Further Exploits
- Leaked information may help attackers:
  - Escalate privileges
  - Perform local file inclusion (LFI)
  - Mount further attacks (e.g., SSRF, RCE)
Works in Reactive and Traditional Apps

Affects both Spring^® WebFlux.fn and Spring^® WebMvc.fn applications, making it relevant across different web stacks.

Steps To Reproduce

Prerequisites

Spring^® Framework 5.3.0 to 5.3.40, 6.0.0 to 6.0.24, or 6.1.0 to 6.1.13
Spring^® WebFlux or Spring^® WebMvc using functional routing (RouterFunctions)
A file or directory exposed using FileSystemResource

1. Create a Spring^® Boot app using WebFlux or WebMvc.fn

@Configuration

public class StaticResourceConfig {

@Bean

public RouterFunction<ServerResponse> staticRoutes() {

return RouterFunctions.resources(“/files/**”, new FileSystemResource(“/your/server/path”));

}

This exposes files from /your/server/path under /files/ URL path.

2. Add a sample file under the exposed path

/your/server/path/index.html

3. Run the application

Navigate to:

http://localhost:8080/files/index.html

✅ Should work and return the file.

4. Attempt a path traversal attack

Try accessing:

http://localhost:8080/files/../../../etc/passwd

or, if encoded:

http://localhost:8080/files/..%2f..%2f..%2f..%2fetc%2fpasswd

If vulnerable, the app will respond with the contents of /etc/passwd (or any readable file outside the allowed directory).

Expected Result (Vulnerable)

The server returns the contents of restricted files outside the intended /files/ folder.
This confirms the path traversal attack worked.

Mitigation

Spring^® Framework 5.3.x is no longer supported by the open source community, as its End of Life date is 2023-06-30. It simply means that the version from that date does not receive any updates to address this issue.

‍Users of the affected components should apply one of the following mitigations:

Leverage TuxCare’s Endless Lifecycle Support, which extends regular community end-of-life security support, then simply just apply our patches.
Upgrade to the 6.1.14 open source community version and accept the risk of not getting any further security updates from the community starting from the 30th of June 2025.
Alternatively, take the effort to upgrade to the latest greatest still 1 year + supported Spring^® Framework open source versions that are not affected e.g. 6.2.5
Use ClassPathResource for static files instead of FileSystemResource
Manually validate and normalize paths before resolving resources

Do you need a fix for this vulnerability for any other Spring^® Framework version, please contact us, we are here to help you!