Skip to main content

CVE-2021-21234

Description​

spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that filename\=../somefile would not work), the base folder parameter was not sufficiently checked, so that filename\=somefile&base\=../ could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.

github_m
CVE ID: CVE-2021-21234
Base Score: 7.7
Base Severity: HIGH
Vector String:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Proof Of Concept​

Nuclei Templates for CVE-2021-21234
PwCNO-CTO

Directory traversal vulnerability in the spring-boot-actuator-logview library

Refrence: GitHub

xiaojiangxl

Refrence: GitHub

Content on GitHub​

AabyssZG | watchers:1592

SpringBoot-Scan
针对SpringBoot的开源渗透框架，以及Spring相关高危漏洞利用工具

Refrence: GitHub

sule01u | watchers:481

SBSCAN
SBSCAN是一款专注于spring框架的渗透测试工具，可以对指定站点进行springboot未授权扫描/敏感信息扫描以及进行spring框架漏洞扫描与验证的综合利用工具。 [SBSCAN is a penetration testing tool focused on the spring framework that can scan springboot sensitive information/unauthorized for specified sites and scan and validate spring related vulnerabilities]

Refrence: GitHub

CLincat | watchers:122

vulcat
vulcat可用于扫描Web端常见的CVE、CNVD等编号的漏洞，发现漏洞时会返回Payload信息。部分漏洞还支持命令行交互模式，可以持续利用漏洞

Refrence: GitHub

Refrence: MITRE