CVE-2021-21234
📋 TL;DR
This CVE describes a directory traversal vulnerability in spring-boot-actuator-logview library versions before 0.2.13. Attackers can exploit insufficient validation of the 'base' parameter to read arbitrary files outside the intended log directory. Any application using vulnerable versions of this library with the logview endpoint exposed is affected.
💻 Affected Systems
- spring-boot-actuator-logview
📦 What is this software?
Spring Boot Actuator Logview by Spring Boot Actuator Logview Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via reading sensitive files like /etc/passwd, SSH keys, configuration files with secrets, or database credentials, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized reading of application configuration files, source code, or other sensitive files in directories accessible to the application user, potentially exposing credentials and business logic.
If Mitigated
Limited file read access restricted to non-sensitive directories if proper file permissions and network controls are implemented.
🎯 Exploit Status
Exploitation requires only HTTP requests with crafted parameters. Public proof-of-concept code and detailed advisory are available in the GitHub security advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.2.13
Vendor Advisory: https://github.com/lukashinsch/spring-boot-actuator-logview/security/advisories/GHSA-p4q6-qxjx-8jgp
Restart Required: Yes
Instructions:
1. Update Maven dependency to version 0.2.13 or later in pom.xml. 2. Run 'mvn clean install' to rebuild. 3. Redeploy the application. 4. Restart the application server.
🔧 Temporary Workarounds
Disable logview endpoint
allRemove or disable the spring-boot-actuator-logview endpoint in application configuration
Remove 'eu.hinsch:spring-boot-actuator-logview' dependency from pom.xml
Set 'management.endpoint.logview.enabled=false' in application.properties
Reverse proxy access control
allConfigure reverse proxy to block access to /actuator/logview endpoint
nginx: location ~ ^/actuator/logview { deny all; }
Apache: <Location /actuator/logview> Require all denied </Location>
🧯 If You Can't Patch
- Restrict file system permissions for the application user to read-only access for required directories only
- Implement network segmentation to limit access to actuator endpoints to trusted networks only
🔍 How to Verify
Check if Vulnerable:
Check pom.xml or build.gradle for dependency 'eu.hinsch:spring-boot-actuator-logview' with version < 0.2.13Check Version:
mvn dependency:tree | grep spring-boot-actuator-logview OR gradle dependencies | grep spring-boot-actuator-logviewVerify Fix Applied:
Verify dependency version is 0.2.13 or higher and test that directory traversal attempts with base=../ parameter return error📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /actuator/logview with 'base' parameter containing '..' or '../' sequences
- File access errors for unexpected paths in application logs
Network Indicators:
- HTTP GET requests to actuator/logview endpoint with unusual parameter combinations
- Traffic patterns showing attempts to access parent directories
SIEM Query:
http.url:"/actuator/logview" AND (http.param.base:".." OR http.param.base:"../")🔗 References
- https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6
- https://github.com/lukashinsch/spring-boot-actuator-logview/commit/760acbb939a8d1f7d1a7dfcd51ca848eea04e772
- https://github.com/lukashinsch/spring-boot-actuator-logview/security/advisories/GHSA-p4q6-qxjx-8jgp
- https://search.maven.org/artifact/eu.hinsch/spring-boot-actuator-logview
- https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6
- https://github.com/lukashinsch/spring-boot-actuator-logview/commit/760acbb939a8d1f7d1a7dfcd51ca848eea04e772
- https://github.com/lukashinsch/spring-boot-actuator-logview/security/advisories/GHSA-p4q6-qxjx-8jgp
- https://search.maven.org/artifact/eu.hinsch/spring-boot-actuator-logview
