CVE-2019-3799
published 2019-05-06CVE-2019-3799: Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow…
PriorityP268medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EXPLOIT
EPSS
85.30%
99.7th percentile
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | communications_cloud_native_core_policy | — | — |
| spring | spring_cloud_config | >= 1.4 < v1.4.6.RELEASE | v1.4.6.RELEASE |
| spring | spring_cloud_config | >= 2.0 < v2.0.4.RELEASE | v2.0.4.RELEASE |
| spring | spring_cloud_config | >= 2.1 < v2.1.2.RELEASE | v2.1.2.RELEASE |
| vmware | spring_cloud_config | >= 1.4.0 < 1.4.6 | 1.4.6 |
| vmware | spring_cloud_config | >= 2.0.0 < 2.0.4 | 2.0.4 |
| vmware | spring_cloud_config | >= 2.1.0 < 2.1.2 | 2.1.2 |
Detection & IOCsextracted from sources · hover to see the quote
url/test/pathtraversal/master/..%252f..%252f..%252f..%252f../etc/passwd
- →Alert on HTTP 200 responses from Spring Cloud Config Server (default port 8888) where the response body contains Unix /etc/passwd content (e.g., matches 'root:.*:0:0:').
- →Monitor Spring Cloud Config Server (spring-cloud-config-server module) for requests with specially crafted URLs containing encoded path traversal sequences that attempt to escape the configuration root. ↗
- ·The Metasploit module uses a default traversal depth of 13 (%252F repetitions) and randomized path segments, meaning the exact URL pattern will vary per request; signature-based detection must account for variable-length traversal sequences. ↗
- ·The leading path segments before 'master/' are randomized alpha strings (3–8 chars), so static URL prefix matching will not reliably catch all exploit attempts. ↗
- ·Red Hat Fuse 7 ships spring-cloud-config-server and is marked 'Will not fix', meaning patching may not be available for all affected deployments; detection/mitigation controls are especially important in those environments. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_oracle6.5MEDIUM
vendor_redhat6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Path Traversal in Spring Cloud Config
ghsa·2019-05-23
CVE-2019-3799 [MEDIUM] CWE-22 Path Traversal in Spring Cloud Config
Path Traversal in Spring Cloud Config
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
OSV
Path Traversal in Spring Cloud Config
osv·2019-05-23
CVE-2019-3799 [MEDIUM] Path Traversal in Spring Cloud Config
Path Traversal in Spring Cloud Config
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Oracle
Oracle Oracle Communications Risk Matrix: Policy (Spring Cloud Config) — CVE-2019-3799
vendor_oracle·2022-04-15·CVSS 6.5
CVE-2019-3799 [MEDIUM] Oracle Oracle Communications Risk Matrix: Policy (Spring Cloud Config) — CVE-2019-3799
Oracle Oracle Communications Risk Matrix: Policy (Spring Cloud Config) vulnerability
CVE: CVE-2019-3799
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Red Hat
spring-cloud-config-server: directory traversal attack using special crafted URL
vendor_redhat·2019-04-16·CVSS 6.5
CVE-2019-3799 [MEDIUM] CWE-22 spring-cloud-config-server: directory traversal attack using special crafted URL
spring-cloud-config-server: directory traversal attack using special crafted URL
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Package: spring-cloud-config-server (Red Hat Fuse 7) - Will not fix
No detection rules found.
Exploit-DB
Spring Cloud Config 2.1.x - Path Traversal (Metasploit)
exploitdb·2019-04-30
CVE-2019-3799 Spring Cloud Config 2.1.x - Path Traversal (Metasploit)
Spring Cloud Config 2.1.x - Path Traversal (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Spring Cloud Config Server Directory Traversal',
'Description' => %q{
This module exploits an unauthenticated directory traversal
vulnerability
which exists in Spring Cloud Config versions 2.1.x prior to 2.1.2,
versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6.
Spring
Cloud Config listens by default on port 8888.
},
'References' =>
[
['CVE', '2019-3799'],
['URL', 'https://pivotal.io/security/cve-2019-3799']
],
'Author' =>
[
'Vern', # Vulnerability discovery
'Dhiraj Mishra' # Metasploit module
],
'DisclosureDate' => '2019-04-17',
'License' => MSF_LICENSE
Nuclei
Spring Cloud Config Server - Local File Inclusion
nuclei·CVSS 6.5
CVE-2019-3799 [MEDIUM] Spring Cloud Config Server - Local File Inclusion
Spring Cloud Config Server - Local File Inclusion
Spring Cloud Config Server versions 2.1.x prior to 2.1.2, 2.0.x prior to 2.0.4, 1.4.x prior to 1.4.6, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files. An attacker can send a request using a specially crafted URL that can lead to a directory traversal attack.
Template:
id: CVE-2019-3799
info:
name: Spring Cloud Config Server - Local File Inclusion
author: madrobot
severity: medium
description: Spring Cloud Config Server versions 2.1.x prior to 2.1.2, 2.0.x prior to 2.0.4, 1.4.x prior to 1.4.6, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files. An attacker c
Metasploit
Spring Cloud Config Server Directory Traversal
metasploit
Spring Cloud Config Server Directory Traversal
Spring Cloud Config Server Directory Traversal
This module exploits an unauthenticated directory traversal vulnerability which exists in Spring Cloud Config versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6. Spring Cloud Config listens by default on port 8888.
2019-05-06
Published