CVE-2024-37084 CVE-2024-37084: Remote code execution in Spring Cloud Data Flow
A malicious user with API access can upload crafted files to arbitrary locations, potentially leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-37084?
CVE-2024-37084 is a critical vulnerability in Spring Cloud Data Flow, published on 25 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server
Weakness: CWE-94
Which versions are affected by CVE-2024-37084?
3 open source packages ship an affected version, including spring-cloud-dataflow and org.springframework.cloud:spring-cloud-skipper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
spring-cloud-dataflow Bitnami | From 2.11.0 | 2.11.4 |
org.springframework.cloud:spring-cloud-skipper Maven | All versions | 2.11.4 |
org.springframework.cloud:spring-cloud-skipper Maven | All versions | 2.11.4 |
Products include Vmware Spring Cloud Data Flow.
How do I fix CVE-2024-37084?
Upgrade spring-cloud-dataflow to 2.11.4 or later.
Is CVE-2024-37084 being exploited?
There is no known exploitation of CVE-2024-37084 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Spring Cloud Data Flow
Sources
Also known as BIT-spring-cloud-dataflow-2024-37084, GHSA-p528-3mvf-gr87.