Arbitrary file upload in Spring Cloud Data Flow

1) Arbitrary file upload

EUVDB-ID: #VU94730

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2024-37084

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

Exploit availability: Yes

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload. A remote user with access to the Skipper server API can upload a malicious file into an arbitrary location on the server and then execute it.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Spring Cloud Data Flow: 2.11.0 RC1 - 2.11.3

CPE2.3

• cpe:2.3:a:pivotal:spring_cloud_data_flow:2.11.0:RC1:*:*:*:*:*:*
• cpe:2.3:a:pivotal:spring_cloud_data_flow:2.11.0:*:*:*:*:*:*:*
• cpe:2.3:a:pivotal:spring_cloud_data_flow:2.11.1:*:*:*:*:*:*:*

External links

https://spring.io/security/cve-2024-37084

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.