CVE-2024-38821 Authorization Bypass of Static Resources in WebFlux Applications
Attackers can bypass authorization rules to access protected static resources in Spring WebFlux applications configured with specific security settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38821?
CVE-2024-38821 is a critical missing authorization vulnerability in Spring, published on 28 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.
For this to impact an application, all of the following must be true:
* It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support
Weakness: CWE-770
Which versions are affected by CVE-2024-38821?
12 open source packages ship an affected version, including org.springframework.security:spring-security-web.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-web Maven | From 5.0.0 | 5.7.13 |
org.springframework.security:spring-security-web Maven | From 5.0.0 | 5.7.13 |
org.springframework.security:spring-security-web Maven | From 5.8.0 | 5.8.15 |
org.springframework.security:spring-security-web Maven | From 5.8.0 | 5.8.15 |
org.springframework.security:spring-security-web Maven | From 6.0.0 | 6.0.13 |
org.springframework.security:spring-security-web Maven | From 6.0.0 | 6.0.13 |
6 more packages
org.springframework.security:spring-security-web Maven | From 6.1.0 | 6.1.11 |
org.springframework.security:spring-security-web Maven | From 6.1.0 | 6.1.11 |
org.springframework.security:spring-security-web Maven | From 6.2.0 | 6.2.7 |
org.springframework.security:spring-security-web Maven | From 6.2.0 | 6.2.7 |
org.springframework.security:spring-security-web Maven | From 6.3.0 | 6.3.4 |
org.springframework.security:spring-security-web Maven | From 6.3.0 | 6.3.4 |
How do I fix CVE-2024-38821?
Upgrade org.springframework.security:spring-security-web to a fixed version for your release line: 5.7.13, 5.8.15, 6.0.13 or 6.1.11.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-38821 being exploited?
There is no known exploitation of CVE-2024-38821 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as CLEANSTART-2026-TA16647, ECHO-508b-98bd-2308, GHSA-c4q5-6c82-3qpw, ROOT-APP-MAVEN-CVE-2024-38821.