Spring Framework Path Traversal Vulnerability in Non-Compliant Servlet Containers

A path traversal vulnerability has been identified in Spring Framework MVC applications deployed on non-compliant Servlet containers. This vulnerability arises when the application is packaged as a WAR file or uses an embedded Servlet container, and the Servlet container fails to properly sanitize URI path sequences. Additionally, the application must serve static resources through Spring's resource handling. While applications on Apache Tomcat and Eclipse Jetty are not vulnerable if default security settings are maintained, this issue can affect several different versions and ranges of Spring Framework.

Impact

Exploitation of this vulnerability allows for path traversal, potentially leading to unauthorized access to files outside the intended directory.

Remediation

Users of Spring Framework versions 6.2.x should upgrade to 6.2.10, those on 6.1.x should upgrade to 6.1.22, and users on 5.3.x should upgrade to 5.3.44. Version 6.0.x is out of support.