CVE-2024-38819 Customer Vault Lab

This is a Cloud Foundry-ready Spring Boot demo for CVE-2024-38819, a Spring Framework path traversal vulnerability in functional static resource handling.

What Is Patched?

CVE-2024-38819 is patched in Spring Framework, not directly in Spring Boot.

Spring Boot is still important in the demo because it manages the Spring Framework dependency versions used by the application. In other words, a Spring Boot maintenance release can bring in the fixed Framework version for you, but the vulnerable code path and the security fix are in Spring Framework's WebFlux/WebMvc functional static resource handling.

The app presents a small customer document vault UI. Public documents are served from /files/** using WebFlux.fn RouterFunctions.resources(...) with a FileSystemResource, which matches the vulnerable conditions in the Spring advisory. At startup the app creates:

• a public document directory
• a fake secret outside that public directory
• a symlink used by the proof request to demonstrate traversal

The secret is generated by the app and contains no real credentials.

Versions

This lab intentionally keeps Spring Boot at 3.3.4 in both modes and changes only the managed Spring Framework version:

The patched Maven profile sets:

<spring-framework.version>6.1.14</spring-framework.version>

Without that profile, Spring Boot 3.3.4 manages Spring Framework 6.1.13, which is the vulnerable version used for the demo.

Build Artifacts

Build both demo artifacts:

scripts/build-artifacts.sh

This creates two distinct deployable jars:

target/cve-2024-38819-vulnerable.jar
target/cve-2024-38819-patched.jar

Local Run

mvn spring-boot:run

Open:

http://127.0.0.1:8080

Run the constrained proof:

python3 scripts/prove-secret-exposure.py --expect vulnerable

Expected vulnerable result:

RESULT: vulnerable behavior confirmed. The fake secret was served from outside the public file root.

Run patched mode:

mvn -Ppatched spring-boot:run

Then:

python3 scripts/prove-secret-exposure.py --expect patched

Cloud Foundry

Push vulnerable:

scripts/cf-push-vulnerable.sh

This deploys target/cve-2024-38819-vulnerable.jar as patch-your-spring-vulnerable.

Run the proof against your app route:

python3 scripts/prove-secret-exposure.py \
  --target https://YOUR-VULNERABLE-ROUTE \
  --allow-remote-demo \
  --expect vulnerable

Push patched:

scripts/cf-push-patched.sh

This deploys target/cve-2024-38819-patched.jar as patch-your-spring-patched.

Run the same proof:

python3 scripts/prove-secret-exposure.py \
  --target https://YOUR-PATCHED-ROUTE \
  --allow-remote-demo \
  --expect patched

Cleanup:

cf delete patch-your-spring-vulnerable -f -r
cf delete patch-your-spring-patched -f -r

References

• Spring advisory: https://spring.io/security/cve-2024-38819/
• Public PoC shape: https://github.com/masa42/CVE-2024-38819-POC
• GitHub advisory: https://github.com/advisories/GHSA-g5vr-rgqm-vf78