CVE-2018-1271: Path Traversal in org.springframework:spring-core

Background

The org.springframework:spring-core package is a core component of the Spring Framework, which is a popular Java-based framework used for building enterprise-level applications. It provides essential functionality and utilities for various Spring modules, including Spring MVC. Spring MVC allows applications to serve static resources such as CSS, JS, and images. These resources can be served from either the classpath, the ServletContext, or the file system on Windows. However, a vulnerability in versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 (and older unsupported versions) allows a malicious user to exploit a directory traversal attack when static resources are served from the file system on Windows.

Vulnerability Detail

The vulnerability arises from a lack of proper input validation and sanitization in the handling of user-supplied URLs. By crafting a specially crafted URL, an attacker can bypass the intended resource restrictions and access arbitrary files on the file system. This can lead to unauthorized disclosure of sensitive information, remote code execution, or other malicious activities. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.

Workaround

If upgrading to a fixed version is not immediately feasible, a temporary workaround is to serve static resources from the classpath or the ServletContext instead of the file system on Windows. This can be achieved by configuring Spring MVC accordingly. Here is an example of how to configure Spring MVC to serve static resources from the classpath:

@Configuration
@EnableWebMvc
public class MvcConfig implements WebMvcConfigurer {

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry
            .addResourceHandler("/resources/**")
            .addResourceLocations("classpath:/static/");
    }

}

By using this workaround, the risk of a directory traversal attack can be mitigated.

Conclusion

In conclusion, the org.springframework:spring-core package is vulnerable to a path traversal attack when serving static resources from the file system on Windows. Upgrading to a fixed version of the Spring Framework is the recommended solution. In the meantime, serving static resources from the classpath or the ServletContext can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.springframework:spring-core →

FAQ