CVE-2024-23639 micronaut-core management endpoints vulnerable to drive-by localhost attack

What is CVE-2024-23639?

CVE-2024-23639 is a medium-severity server-side request forgery vulnerability in micronaut-projects micronaut-core, published on 9 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought. A malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered. Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development. This issue has been addressed in version 3.8.3. Users are advised to upgrade.

Weakness: CWE-664, CWE-610, CWE-15

Which versions are affected by CVE-2024-23639?

6 open source packages ship an affected version, including io.micronaut:micronaut-http-server, io.micronaut:micronaut-http-server-netty and io.micronaut:micronaut-http-server-tck. It affects 1 product.

Products include Objectcomputing Micronaut.

How do I fix CVE-2024-23639?

Upgrade io.micronaut:micronaut-http-server to 3.8.3 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-23639 being exploited?

There is no known exploitation of CVE-2024-23639 in the wild and no public exploit code.

Other vulnerabilities in micronaut-projects micronaut-core

• CVE-2020-7611 Micronaut's HTTP client is vulnerable to HTTP Request Header Injection Critical 9.8
• CVE-2026-33013 Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices High 8.2
• CVE-2026-33012 Micronaut Framework vulnerable to a Denial of Service in HTML error response caching High 7.5
• CVE-2021-32769 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core High 7.5
• CVE-2022-21700 Memory leak in micronaut-core Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-583g-g682-crxf.