CVE-2021-32769
📋 TL;DR
This CVE describes a path traversal vulnerability in Micronaut framework versions prior to 2.5.9. Attackers can access arbitrary files on the filesystem by using directory traversal sequences like '/../../' in URLs. This affects all Micronaut applications with basic file-serving configurations.
💻 Affected Systems
- Micronaut Framework
📦 What is this software?
Micronaut by Objectcomputing
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like /etc/passwd, SSH keys, database credentials, or application configuration files containing secrets.
Likely Case
Exfiltration of sensitive configuration files, source code, or credentials leading to data breach or further system compromise.
If Mitigated
Limited to accessing only files within the intended directory structure with proper path validation.
🎯 Exploit Status
Simple HTTP requests with path traversal sequences can exploit this vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.9
Vendor Advisory: https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjx7-399x-p2rj
Restart Required: Yes
Instructions:
1. Update Micronaut dependency to version 2.5.9 or later in build.gradle or pom.xml. 2. Rebuild and redeploy the application. 3. Restart the application server.
🔧 Temporary Workarounds
Restrict path mapping
allChange file-serving configuration from '**' to '*' to only expose flat directory structure
Modify configuration to use single asterisk pattern instead of double asterisk for file mappings
Chroot isolation
linuxRun Micronaut application in chroot jail on Linux systems
chroot /path/to/chroot/jail java -jar application.jar
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block path traversal patterns
- Restrict file-serving functionality entirely or move to dedicated file server
🔍 How to Verify
Check if Vulnerable:
Check if application serves files and test with URL containing '/../../etc/passwd' or similar traversal sequencesCheck Version:
Check build.gradle or pom.xml for micronaut-core version, or run: java -jar app.jar --versionVerify Fix Applied:
After patching, test that path traversal attempts return 404 or proper error instead of file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '/../' patterns
- Unusual file access patterns from web endpoints
- 404 errors for traversal attempts after patching
Network Indicators:
- HTTP requests with multiple directory traversal sequences in URL path
SIEM Query:
web.url:*../..* AND (response.status:200 OR response.size>0)🔗 References
- https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d16d4a3b91b34b7456bb11
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjx7-399x-p2rj
- https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d16d4a3b91b34b7456bb11
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjx7-399x-p2rj
