Path Traversal in Spring WebMvc.fn and WebFlux.fn Static Resource Handling

This repository is a self-contained demo lab and proof-of-concept for CVE-2024-38819, a Spring Framework path traversal issue affecting functional static resource handling in WebFlux. It is not part of a major exploit framework. The repo contains a Spring Boot application, helper shell scripts for building and Cloud Foundry deployment, and a Python proof harness that validates whether the target is vulnerable and then requests a traversal path to retrieve a fake secret. Repository structure: the main exploit logic is split between Java application code under src/main/java and the Python verifier under scripts/prove-secret-exposure.py. DemoFileStore.java prepares the lab filesystem at startup: it creates a public directory, an exposed directory, a secrets directory, writes benign public files, writes a fake secret file outside the public root, and creates a symlink public/link -> exposed. StaticResourceRoutes.java exposes /files/** using RouterFunctions.resources(...) backed by a FileSystemResource rooted at the public directory, matching the vulnerable pattern described in the advisory. LabController.java exposes /api/lab/status and /api/lab/reset for UI and proof-script interaction. TraversalSignalFilter.java records successful secret exposure attempts by watching for 200 responses to traversal-shaped requests. PathTraversalLabApplication.java is the Spring Boot entry point. The HTML template provides a dashboard for observing lab state. Exploit capability: the proof demonstrates unauthorized file read outside the intended static resource directory. The Python script first verifies the target by calling /api/lab/status and checking labId == cve-2024-38819-lab, then extracts exploitPath from the JSON response and performs a GET request to that path. In the vulnerable build, the path /files/link/%2e%2e/secrets/customer-secrets.properties returns the fake secret file, confirming traversal through the symlinked route. In the patched build, the same request should fail to expose the file. Targeting: the vulnerable mode uses Spring Boot 3.3.4 with Spring Framework 6.1.13; the patched profile keeps Boot at 3.3.4 but overrides Spring Framework to 6.1.14. The exploit is therefore aimed at Spring Framework functional static resource handling rather than Spring Boot itself. Operational notes: this is a constrained lab PoC rather than a weaponized exploit. The Python harness intentionally refuses non-loopback targets unless --allow-remote-demo is supplied, and it expects the target to expose the lab-specific status endpoint. No code execution payload is present; the demonstrated impact is file disclosure.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-38819, a path traversal vulnerability in Spring Framework (as used in Spring Boot 3.3.4/Spring Framework 6.1.13). The repository is structured into two main directories: 'vuln' (vulnerable version) and 'safe' (presumably patched or safe version), each containing a Dockerfile, build.gradle, and a Java application file. The Java application sets up a static file server using Spring WebFlux's RouterFunction, serving files from '/app/static/'. The Dockerfile creates a symbolic link '/app/static/link' pointing to '/static'. The exploit leverages a crafted HTTP request to '/static/link/%2e%2e/etc/passwd', using percent-encoding to traverse directories and access arbitrary files on the server, such as '/etc/passwd'. The README provides clear instructions for building, running, and exploiting the vulnerable container. The main exploit capability is arbitrary file read via HTTP path traversal. The repository is a clear, educational PoC and does not contain weaponized or framework-based code.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-38819, a path traversal vulnerability in Spring Framework (6.1.13) as used in Spring Boot (3.3.4). The repository is structured into two main directories: 'vuln' (vulnerable version) and 'safe' (presumably patched or safe version), each containing a Dockerfile, build.gradle, and a Java application file. The Java application exposes static files via a Spring WebFlux RouterFunction, serving files from '/app/static/'. The Dockerfile creates a symbolic link '/app/static/link' pointing to '/static', which is exploited by sending a percent-encoded directory traversal payload (e.g., '%2e%2e') in the URL. By accessing 'http://localhost:8080/static/link/%2e%2e/etc/passwd', an attacker can read arbitrary files from the server, demonstrating the vulnerability. The exploit is executed via a simple curl command, and the PoC is intended for educational and research purposes only.