CVE-2023-38493 Paths contain matrix variables bypass decorators
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2023-38493?
CVE-2023-38493 is a high-severity vulnerability in line armeria, published on 25 Jul 2023.
Official description
Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer. Version 1.24.3 contains a patch for this issue.
Weakness: CWE-863
Which versions are affected by CVE-2023-38493?
2 open source packages ship an affected version, including com.linecorp.armeria:armeria. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.linecorp.armeria:armeria Maven | All versions | 1.24.3 |
com.linecorp.armeria:armeria Maven | All versions | 1.24.3 |
Products include Linecorp Armeria.
How do I fix CVE-2023-38493?
Upgrade com.linecorp.armeria:armeria to 1.24.3 or later.
Is CVE-2023-38493 being exploited?
There is no known exploitation of CVE-2023-38493 in the wild and no public exploit code.
Other vulnerabilities in line armeria
- CVE-2024-1735 Armeria SAML authentication bypass due to missing validation on unsigned SAML messages
- CVE-2021-43795 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria
- CVE-2019-16771 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria
Sources
Also known as GHSA-wvp2-9ppw-337j, ROOT-APP-MAVEN-CVE-2023-38493.