CVE-2021-21234: Directory Traversal in spring-boot-actuator-logview
Summary
CVE-2021-21234: Directory Traversal in spring-boot-actuator-logview. Affects eu.hinsch:spring-boot-actuator-logview versions < 0.2.13. Fixed in 0.2.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spring-boot-actuator-logview package is a library that exposes a log file directory via admin (spring boot actuator) HTTP endpoints. It allows users to view log files by specifying the filename and a base folder relative to the logging folder root. This package is vulnerable to a directory traversal exploit, where an attacker can access files outside the logging base directory by manipulating the base folder parameter.
Vulnerability Detail
The vulnerability arises from insufficient checking of the base folder parameter. While the filename parameter is properly validated to prevent directory traversal exploits, the base folder parameter is not adequately checked. This allows an attacker to specify a base folder such as '../' and access files outside the logging base directory. The impact of this vulnerability can be significant as it allows unauthorized access to sensitive files on the system.
How To Fix
Minimum fixed version
0.2.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, there are a couple of workarounds that can limit the impact of the vulnerability. Firstly, removing read access of the user running the application to any directory not required for its operation can help mitigate the risk. Additionally, deploying the application behind a reverse proxy and limiting access to the logview endpoint can provide an extra layer of protection.
Conclusion
The spring-boot-actuator-logview package is vulnerable to a directory traversal exploit that allows unauthorized access to files outside the logging base directory. Users are strongly advised to update to version 0.2.13 of the package to fix the vulnerability. Alternatively, implementing the provided workarounds can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for eu.hinsch:spring-boot-actuator-logview →
FAQ
The spring-boot-actuator-logview package is a library that exposes log files via admin HTTP endpoints in a Spring Boot application.
The vulnerability allows an attacker to access files outside the logging base directory by manipulating the base folder parameter.
The vulnerability enables unauthorized access to sensitive files on the system, potentially exposing confidential information.
Yes, the vulnerability has been patched in release 0.2.13 of the spring-boot-actuator-logview package.
Yes, removing unnecessary read access to directories and deploying the application behind a reverse proxy can help limit the impact of the vulnerability.
