CVE-2024-23639: Micronaut management endpoints vulnerable to drive-by localhost attack
Summary
CVE-2024-23639: Micronaut management endpoints vulnerable to drive-by localhost attack. Affects io.micronaut:micronaut-http-server versions < 3.8.3. Fixed in 3.8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Micronaut is a modern, JVM-based framework for building modular, easily testable microservice and serverless applications. It provides a lightweight and efficient runtime for developing and deploying microservices. The vulnerability affects the Micronaut management endpoints, which are typically used for monitoring and managing the application. These endpoints, if enabled and not secured, can be exploited by a malicious website to make HTTP requests to the localhost.
Vulnerability Detail
The vulnerability arises from the lack of proper security measures on the enabled but unsecured management endpoints. A malicious or compromised website can bypass CORS preflight checks and directly make simple HTTP requests to the localhost. While this vulnerability is not common in production environments where unused endpoints are disabled and access to needed endpoints is restricted, it can have a significant impact on developers working in local development environments. Developers often enable endpoints without proper security measures to ease development, making them vulnerable to drive-by localhost attacks.
How To Fix
Minimum fixed version
3.8.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually secure the management endpoints by implementing CORS policies and access controls. This can be done by configuring the Micronaut application to only allow requests from trusted domains and enforcing authentication and authorization for accessing the endpoints. Here is an example of how to configure CORS policies in a Micronaut application:
micronaut:
security:
enabled: true
server:
cors:
enabled: true
configurations:
default:
allowedOrigins:
- https://trusted-domain.com
allowedMethods:
- GET
- POST
allowedHeaders:
- Content-Type
allowCredentials: true
maxAge: 1h
This configuration allows requests only from the https://trusted-domain.com domain, allows only GET and POST methods, and allows the Content-Type header. It also enables credentials and sets the maximum age of the preflight request to 1 hour.
Conclusion
The vulnerability in Micronaut management endpoints can be exploited by a malicious website to perform drive-by localhost attacks. While production environments typically disable unused endpoints and secure necessary endpoints, developers working in local development environments may be at risk if they have enabled endpoints without proper security measures. To mitigate this vulnerability, it is crucial to update the affected packages to version 3.8.3 or later and review and secure the management endpoints in production environments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.micronaut:micronaut-http-server →
FAQ
The impact of this vulnerability is more significant in local development environments where developers may have enabled management endpoints without proper security measures. In production environments, unused endpoints are typically disabled and access to needed endpoints is restricted, reducing the risk of exploitation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
Yes, a temporary workaround is to manually secure the management endpoints by implementing CORS policies and access controls. This involves configuring the Micronaut application to only allow requests from trusted domains and enforcing authentication and authorization for accessing the endpoints.
Yes, the vulnerability can be fixed by updating the affected packages to version 3.8.3 or later. This update includes the necessary security enhancements to prevent drive-by localhost attacks.
The CVSS score of this vulnerability is 5.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.micronaut:micronaut-http-server.
