CVE-2020-5410
published 2020-06-02CVE-2020-5410: Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary…
PriorityP189high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
95.59%
99.9th percentile
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring_by_vmware | spring_cloud_config | >= 2.1 < 2.1.9 | 2.1.9 |
| spring_by_vmware | spring_cloud_config | >= 2.2 < 2.2.3 | 2.2.3 |
| vmware | spring_cloud_config | >= 2.1.0 < 2.1.9 | 2.1.9 |
| vmware | spring_cloud_config | >= 2.2.0 < 2.2.3 | 2.2.3 |
Detection & IOCsextracted from sources · hover to see the quote
url/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%23foo/development↗
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT VMware Spring Cloud Directory Traversal (CVE-2020-5410)"; flow:established,to_server; http.method; content:"GET"; http.uri.raw; content:"/..%252F..%252F"; nocase; fast_pattern; reference:url,xz.aliyun.com/t/7877; reference:cve,2020-5410; classtype:attempted-admin; sid:2030337; rev:2; metadata:affected_product VMware, created_at 2020_06_15, cve CVE_2020_5410, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
bytes
/..%252F..%252F
- →Match HTTP GET requests where the raw URI contains the double-percent-encoded traversal sequence `/..%252F..%252F` (double URL-encoded `../`). This is the canonical exploit pattern for CVE-2020-5410.
- →The Nuclei template matches a successful exploitation response by checking HTTP 200 status AND a body regex matching `root:.*:0:0:` (contents of /etc/passwd), confirming LFI.
- →Spring Cloud Config Server should only be accessible on internal networks; exposure on perimeter/internet-facing interfaces is a strong risk indicator. ↗
- ·The Metasploit module targets port 8888 by default, but Spring Cloud Config Server may be deployed on other ports. Ensure detection rules cover all ports, not just 8888. ↗
- ·The ET rule uses `nocase` on the URI match, meaning both upper- and lower-case hex encoding variants of the traversal sequence should be considered in custom detections.
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck7.5HIGH
cisa7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Common (Spring Cloud Config) — CVE-2020-5410
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2020-5410 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Common (Spring Cloud Config) — CVE-2020-5410
Oracle Oracle Financial Services Applications Risk Matrix: Common (Spring Cloud Config) vulnerability
CVE: CVE-2020-5410
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
CISA
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
cisa·2022-03-25·CVSS 7.5
CVE-2020-5410 [HIGH] CWE-23 VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
Vulnerability: VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
Affected: VMware Tanzu Spring Cloud Configuration (Config) Server
Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-5410
Remediation Due Date: 2022-04-15
Red Hat
spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack
vendor_redhat·2020-05-15·CVSS 7.5
CVE-2020-5410 [HIGH] CWE-22 spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack
spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
A flaw was found in spring-cloud-config in versions prior to 2.1.9 and 2.2.3. Applications are allowed to serve arbitrary configuration files through the spring-cloud-config-server module allowing an attacker to send a request using a specially crafted URL to create a directory traversal attack. The highest threat from this vulnerabi
OSV
Directory traversal attack in Spring Cloud Config
osv·2020-06-05
CVE-2020-5410 [HIGH] Directory traversal attack in Spring Cloud Config
Directory traversal attack in Spring Cloud Config
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
GHSA
Directory traversal attack in Spring Cloud Config
ghsa·2020-06-05
CVE-2020-5410 [HIGH] CWE-22 Directory traversal attack in Spring Cloud Config
Directory traversal attack in Spring Cloud Config
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
VulnCheck
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
vulncheck·2020·CVSS 7.5
CVE-2020-5410 [HIGH] CWE-23 VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.
Affected: VMware Spring Cloud Configuration (Config) Server
Required Action: Apply updates per vendor instructions.
Exploitation References: https://blog.checkpoint.com/security/december-2021s-most-wanted-malware-trickbot-emotet-and-the-log4j-plague/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://blog.checkpoint.com/security/april-2022s-most-wanted-malware-a-shake-up-in-the-index-but-emotet-is-still-on-top/; https://blog.checkpoint.com/security/april-2024s-most-wanted-malware-surge-in-androxgh0st-attacks-and-the-decline-of-lockbit3/;
Suricata
ET EXPLOIT VMware Spring Cloud Directory Traversal (CVE-2020-5410)
suricata·2020-06-15·CVSS 7.5
CVE-2020-5410 [HIGH] ET EXPLOIT VMware Spring Cloud Directory Traversal (CVE-2020-5410)
ET EXPLOIT VMware Spring Cloud Directory Traversal (CVE-2020-5410)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT VMware Spring Cloud Directory Traversal (CVE-2020-5410)"; flow:established,to_server; http.method; content:"GET"; http.uri.raw; content:"/..%252F..%252F"; nocase; fast_pattern; reference:url,xz.aliyun.com/t/7877; reference:cve,2020-5410; classtype:attempted-admin; sid:2030337; rev:2; metadata:affected_product VMware, created_at 2020_06_15, cve CVE_2020_5410, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery
Nuclei
Spring Cloud Config Server - Local File Inclusion
nuclei·CVSS 7.5
CVE-2020-5410 [HIGH] Spring Cloud Config Server - Local File Inclusion
Spring Cloud Config Server - Local File Inclusion
Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafted URL that can lead to a local file inclusion attack.
Template:
id: CVE-2020-5410
info:
name: Spring Cloud Config Server - Local File Inclusion
author: mavericknerd
severity: high
description: Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker ca
Metasploit
Directory Traversal in Spring Cloud Config Server
metasploit
Directory Traversal in Spring Cloud Config Server
Directory Traversal in Spring Cloud Config Server
This module exploits an unauthenticated directory traversal vulnerability which exists in Spring Cloud Config versions 2.2.x prior to 2.2.3 and 2.1.x prior to 2.1.9, and older unsupported versions. Spring Cloud Config listens by default on port 8888.
2020-06-02
Published
2022-03-25
Added to CISA KEV
Exploited in the wild