Description

Spring Cloud Config allows applications to server arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

Affected Spring Products and Versions

Spring Cloud Config:

• 3.1.x
• 4.1.x
• 4.2.x
• 4.3.x
• 5.0.x
• Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Credit

The issue was identified and responsibly reported by Swapnil Paliwal and the security team at AxiomCode using the AxiomEngine, August829, and rash18mi.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N&version=3.1