CVE-2019-3799 Directory Traversal with spring-cloud-config-server
Attackers can read arbitrary configuration files via directory traversal in Spring Cloud Config Server, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-3799?
CVE-2019-3799 is a medium-severity path traversal vulnerability in Oracle Communications Cloud Native Core Policy, published on 6 May 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Weakness: CWE-22
Which versions are affected by CVE-2019-3799?
6 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-config-server. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-config-server Maven | All versions | 1.4.6 |
org.springframework.cloud:spring-cloud-config-server Maven | All versions | 1.4.6 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.0.0 | 2.0.4 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.0.0 | 2.0.4 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.1.0 | 2.1.2 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.1.0 | 2.1.2 |
Products include Oracle Communications Cloud Native Core Policy, Vmware Spring Cloud Config.
How do I fix CVE-2019-3799?
Upgrade org.springframework.cloud:spring-cloud-config-server to a fixed version for your release line: 1.4.6, 2.0.4 or 2.1.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-3799 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-3799 exists.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Oracle Communications Cloud Native Core Policy
- CVE-2021-35574 Denial of service in Outside In Technology
- CVE-2021-22119 Resource Exhaustion in Spring Security
- CVE-2021-23440 Prototype Pollution
- CVE-2021-33880 Observable Timing Discrepancy in aaugustin websockets library
All Oracle Communications Cloud Native Core Policy vulnerabilities
Sources
Also known as GHSA-4x49-w62v-76q7.