Patchfirst
Patchfirst
CVE-2019-3799 Public exploit EPSS 85.3%

Directory Traversal with spring-cloud-config-server

Spring · Spring Cloud Config

Summary

Spring Cloud Config's spring-cloud-config-server module contains a path traversal flaw that causes it to serve arbitrary configuration files from the server. An attacker who can send a specially crafted URL to the server can exploit it to read files outside the intended directory, with no authentication, user interaction, or specific configuration described as required.

Official description · CVE.org

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Breakdown
26.3 / 100
Exploited
Not confirmed
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

Public exploit code (PoC-in-GitHub) was available 19 days before disclosure.

  1. Public exploit codePoC-in-GitHub19 days before
  2. Disclosedday 0

4 fixes in spring-cloud-config-server over 7 years. The latest fix listed for spring-cloud-config-server is 5.0.2.

Fixes in spring-cloud-config-serverMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.2CVE-2019-37996 May 2019
  2. 2.2.2CVE-2020-54055 Mar 2020
  3. 2.2.3CVE-2020-54102 Jun 2020KEV
  4. 5.0.2CVE-2026-2273924 Mar 2026Latest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Exploit Public-Facing Application T1190
MITRE CTID mapping of the CVE · how it is exploited

CollectionTA0009

Data from Local System T1005
MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 163 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-3799 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Data from Local SystemT100514 general rules
All 14 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.springframework.cloud:spring-cloud-config-server.

Mavenorg.springframework.cloud:spring-cloud-config-serverGHSA-4x49-w62v-76q7

Upgrade to 2.1.9 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2020-5405, CVE-2020-5410).

Set the version to 2.1.9 or later in your pom.xml or build.gradle.

First fixed in 2.1.2 for CVE-2019-3799.

Affected versions, by release line

If you runUpgrade to
2.1.0 up to 2.1.22.1.9first fix for this CVE: 2.1.2
2.0.0 up to 2.0.42.0.4
All versions before 1.4.61.4.6

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 3 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

x_refsource_MISC 1

oracle.com/security-alerts/cpuapr2022.html

x_refsource_CONFIRM 1

pivotal.io/security/cve-2019-3799
↑ ↓ chooseEnter openEsc close