CVE-2020-5405: Directory Traversal Attack in Spring Cloud Config
Summary
CVE-2020-5405: Directory traversal attack in Spring Cloud Config. Affects org.springframework.cloud:spring-cloud-config-server across 2 version ranges.
>= 2.1.0, < 2.1.7
>= 2.2.0, < 2.2.2
Fixed in 2.1.7 or 2.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Cloud Config is a module in the Spring Cloud framework that provides server and client-side support for externalized configuration in a distributed system. It allows applications to retrieve their configuration from a centralized server. The Spring Cloud Config Server module is responsible for serving the configuration files to the client applications. However, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions of Spring Cloud Config are vulnerable to a directory traversal attack.
Vulnerability Detail
The vulnerability in Spring Cloud Config allows malicious users or attackers to exploit a directory traversal vulnerability in the spring-cloud-config-server module. By sending a specially crafted URL, an attacker can traverse directories and access arbitrary configuration files. This can lead to unauthorized access to sensitive information or the execution of arbitrary code on the server. The vulnerability has a CVSS score of 6.5, indicating a moderate severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.72.1.7 -
>= 2.2.0, < 2.2.22.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed versions as soon as possible.
Conclusion
The directory traversal vulnerability in Spring Cloud Config can be exploited by attackers to access arbitrary configuration files. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Spring Cloud Config. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-config-server →
FAQ
Spring Cloud Config is a module in the Spring Cloud framework that provides server and client-side support for externalized configuration in a distributed system.
Versions 2.2.x prior to 2.2.2 and versions 2.1.x prior to 2.1.7 are affected. Older unsupported versions may also be vulnerable.
A directory traversal attack is a type of vulnerability where an attacker can access files or directories outside of the intended scope. In this case, it allows an attacker to retrieve arbitrary configuration files from the server.
The vulnerability can lead to unauthorized access to sensitive configuration information or the execution of arbitrary code on the server, depending on the files accessed.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.cloud:spring-cloud-config-server.
