CVE-2023-34062

What it actually does

The vulnerability is a path traversal flaw in the Reactor Netty HTTP Server. An unauthenticated, remote attacker can send a specially crafted HTTP request containing URL-encoded traversal sequences (e.g., '..%2f'). The server fails to properly sanitize this input when serving static files, allowing the attacker to navigate outside of the intended web root directory and read arbitrary files on the server's filesystem, constrained only by the file permissions of the running process.

Why it matters to the business

Exploitation of this vulnerability can lead to the exfiltration of sensitive data, such as application source code, configuration files containing credentials, and other proprietary business information. This data breach could result in significant financial loss, regulatory penalties, reputational damage, and a loss of customer trust. Stolen credentials could also serve as a foothold for attackers to move laterally within the network, escalating the security incident.

How an attack unfolds

An unauthenticated attacker identifies a web application using a vulnerable version of Reactor Netty that is configured to serve static files. The attacker then crafts an HTTP GET request with a URL containing path traversal sequences, like '..%2f'. When the vulnerable server receives this request, it incorrectly processes the path, allowing access to files outside the designated static resource directory. The attacker can systematically probe for and retrieve sensitive files, such as '/etc/passwd' or application credentials, which are then returned in the HTTP response, effectively exfiltrating them.

How to fix it

To remediate this vulnerability, developers should upgrade the Reactor Netty library to a patched version. For applications on the 1.1.x release train, upgrade to version 1.1.13 or later. For applications on the 1.0.x release train, upgrade to version 1.0.39 or later. If an immediate upgrade is not feasible, consider disabling the static resource serving feature in Reactor Netty or implementing a Web Application Firewall (WAF) with rules to block path traversal attack patterns.

How to confirm the fix worked

To validate the fix, first confirm that the project's dependencies have been updated to a non-vulnerable version of Reactor Netty (1.1.13+ or 1.0.39+) by inspecting build files (e.g., pom.xml, build.gradle) or using a Software Composition Analysis (SCA) tool. For active testing in a safe, non-production environment, send a request with a traversal payload (e.g., `curl http://<host>/<static-path>/..%2f..%2f..%2fetc/passwd`). A patched system should respond with an error (e.g., 404 Not Found), not the contents of the file.

Typical attack path

1. The attacker identifies a public-facing web server running an application built with a vulnerable version of Reactor Netty.
2. The attacker confirms the application is configured to serve static resources from the filesystem.
3. The attacker crafts a malicious HTTP request containing path traversal sequences in the URL to target a sensitive file.
4. The attacker sends the request to the server.
5. The vulnerable server processes the request, bypasses the directory restrictions, and returns the contents of the targeted file.
6. The attacker receives the sensitive file and may use the information to launch further attacks.

How to detect it

Monitor web server and load balancer access logs for HTTP requests containing URL-encoded path traversal sequences in the URI. Suspicious indicators include patterns like '..%2f', '%2e%2e%2f', '..%5c', and their double-encoded variants. Successful exploitation may be indicated by a 200 OK status code in response to such a request, particularly if the request targets known sensitive system or configuration files (e.g., '/etc/passwd', 'application.properties', '.env').

• ..%2f
• %2e%2e%2f
• ..%5c
• %2e%2e%5c
• ..\
• %2e%2e/
• ../

What your security team should do

• Use a Software Composition Analysis (SCA) tool to identify all applications using vulnerable versions of Reactor Netty and prioritize them for immediate patching.
• Deploy or update Web Application Firewall (WAF) rules to detect and block requests containing path traversal sequences like '../', '..%2f', and '..%5c' as a compensating control.
• Review web server configurations to determine which applications serve static resources via Reactor Netty, as they are the ones at risk.