Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/skrkcb2/cve-2024-38819
Vulnerability AnalysisExploitationWeb SecurityPenetration TestingPapers & ResearchLearning & Education
GitHubskrkcb2/cve-2024-38819

cve-2024-38819

In-depth analysis of CVE-2024-38819, a Spring WebFlux file traversal vulnerability, with code-level breakdown, PoC, and mitigation strategies including filters and IPS rules.

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-38819

01. File-Traversal and Webflux Overview

  • 1) File-Traversal and WebFlux Overview

    File-Traversal (Path Traversal) vulnerability allows an attacker to bypass file system permissions in a web application and access arbitrary files, and is a type of attack designated as CWE-22.

    Spring WebFlux is a module introduced in Spring 5 that supports reactive programming, enabling asynchronous non-blocking application development. WebFlux.fn provides functional endpoint routing, supporting concise and flexible routing configuration using lambda expressions.

    CVE-2024-38819 occurs in applications using WebFlux.fn and WebMVC.fn. This document aims to examine how the vulnerability occurs in WebFlux by reviewing the code flow and to explore corresponding countermeasures.

02. Analysis of File-Traversal Vulnerability in Webflux 6.13

  • 2.1 File-Traversal Analysis Using Webflux 6.13

    In Spring Webflux 6.13, a File-Traversal attack can be performed through an example of serving static resources.
    We will examine how File-Traversal is induced using Spring Webflux through the example.
[Figure 1] shows Spring WebFlux serving all requests coming to /static/** from the server's C:/file directory by finding them. Here, during the call to RouterFunctions.resources, the problem begins in the PathResourceLookupFunction.class of webflux [Figure 2], [Figure 3]. [Figure 2] PathResourceLookupFunction - apply checks whether a given path points to a valid resource in Spring WebFlux and returns the resource as a Mono. In this process, the vulnerability occurs in the isInvalidPath function during several steps including path matching, validation, path decoding, and resource access. Looking at [Figure 3] PathResourceLookupFunction - isInvalidPath, there is a condition StringUtils.cleanPath(path).contains("../"). When a request like http://localhost:8080/static/file/../Windows/System32/drivers/etc/hosts is made, this condition cannot be true. The reason is: Looking at [Figure 4] StringUtils.class - cleanPath, StringUtils.cleanPath(path) removes TOP_PATH("..") and then puts the path into pathElements, making top 0. Therefore, an attack string containing ".." once is processed as a normal path. Consequently, the isInvalidPath function in [Figure 3] returns false. The path passed in [Figure 5] is validated again through cleanPath in [Figure 6] via the cleanPath call in isResourceUnderLocation. The path passed in [Figure 5] is C:/file../Windows/System32/drivers/etc/hosts. Through the code in [Figure 7], the prefix becomes C:/ , and the path is changed to /Windows/System32/drivers/etc/hosts via [Figure 4]. The final return is C:/Windows/System32/drivers/etc/hosts.

1) File-Traversal Attack Flow Using Spring Webflux 6.13

Image description

[Figure 1] FileApplication.java



Image description

[Figure 2] PathResourceLookupFunction.class - apply



Image description

[Figure 3] PathResourceLookupFunction.class - isInvalidPath


Image description

Image description

[Figure 4] StringUtils.class - cleanPath


Image description

[Figure 5] PathResourceLookupFunction.class - apply - 2

Image description

[Figure 6] PathResourceLookupFunction.class - isResourceUnderLocation

Image description

[Figure 7] StringUtils.class - cleanPath -2


2) File-Traversal Attack Example Using Spring Webflux 6.13

Currently, the test was conducted on Windows with C:/file, but this case is very dangerous when combined with symbolic links on Linux.
(When setting ../../ twice, it behaves normally; vulnerability occurs only with a single ../ ) 20250207_150316

2-1) File-Traversal Attack Example 2 Using Spring Webflux 6.13

Attack combined with symbolic link on Linux server

root@kitploit:~
 public RouterFunction<ServerResponse> staticResourceRouter() {
     return RouterFunctions.resources("/static/**", new FileSystemResource("/app/static/"));
 }

Add symbolic link: ln -s /static /app/static/link, then attack 20250208_101836

03. Countermeasures

We have reviewed the flow of File Traversal (CVE-2024-38819) in the Spring Webflux environment. Since this attack method steals server information, countermeasures are important. We propose updating to the latest version, creating additional validation logic, and blocking via IPS.

  • Spring Framework Update

    Refer to the table below and check your version, then upgrade.

    Image description

  • Example of Additional Validation Logic

    As seen in the attack examples, cases where TOP_PATH(..) is included once are problematic. A simple filter logic (for reference; developers may add more).
    root@kitploit:~
    @Bean
public RouterFunction<ServerResponse> staticResourceRouter() {    
  return RouterFunctions.resources("/static/**", new FileSystemResource("C:/file"))
          .filter((request, next) -> {
              String path = request.path();
              if (path.contains("..")) {
                 if(!StringUtils.cleanPath(path).contains("../")) {
                     return ServerResponse.status(HttpStatus.FORBIDDEN).bodyValue("Vuln path access.");
                 }        
              }
              return next.handle(request);
          });
}

  • Blocking via IPS

    Attack example: request via Postman including ../ in the URL
    image Block all URL requests that cause parent directory movement (../)
    20250210_150316

04. Conclusion

We have examined File Traversal through Webflux. This vulnerability occurred when the problem originating from the StringUtils.cleanPath() logic was not recognized and used.

05. References

(POC) https://github.com/masa42/CVE-2024-38819-POC
(Spring Official) https://spring.io/security/cve-2024-38819
(CVE-DETAIL) https://www.cvedetails.com/cve/CVE-2024-38819/
(NIST) https://nvd.nist.gov/vuln/detail/cve-2024-38819

Download Tool