CVE-2025-41242

What it actually does

This vulnerability allows unauthenticated remote path traversal in Spring Framework MVC applications that serve static resources through Spring resource handling when they are deployed as a WAR or embedded Servlet application on a Servlet container that does not properly reject or canonicalize suspicious URI path sequences. Under the vulnerable conditions, crafted request paths containing traversal or encoded traversal sequences may escape the intended static resource directory and cause the application to disclose files readable by the application process. The primary technical impact is confidentiality loss; the CVSS vector indicates network exploitation, no required authentication or user interaction, high attack complexity, and high confidentiality impact with no direct integrity or availability impact. Default Apache Tomcat and Eclipse Jetty configurations are reported not vulnerable as long as their default URI normalization and rejection protections have not been disabled.

Why it matters to the business

Successful exploitation can expose sensitive application files, configuration data, credentials, source artifacts, or other files packaged with or readable by the application runtime. This can lead to follow-on compromise if leaked files contain secrets, database connection strings, signing keys, cloud credentials, or internal service endpoints. Although the issue is not currently listed in CISA KEV and the EPSS score is relatively low, exploit maturity is reported as weaponized, so internet-facing Spring MVC applications using non-standard, embedded, or security-weakened Servlet containers should be treated with elevated urgency. Organizations with broad Java/Spring usage or containerized deployments based on the affected Chainguard OpenJDK 11 OpenJ9 packages should prioritize inventory and upgrade activity to reduce exposure.

How an attack unfolds

An attacker first identifies a Spring MVC application that serves static resources, such as assets under common resource paths. They then test whether the front-end server, proxy, Servlet container, and Spring resource handler preserve or mishandle suspicious path sequences rather than rejecting them during URI canonicalization. If the deployment uses a non-compliant or misconfigured Servlet container, the attacker sends crafted HTTP requests containing traversal patterns, including encoded variants, to a static resource URL. When the path is resolved incorrectly, Spring resource handling may attempt to serve a file outside the intended static resource location. The attacker iterates over likely file names and locations to retrieve sensitive configuration files, packaged application metadata, source maps, templates, certificates, or runtime-readable secrets. Any disclosed secrets can then be used for credential theft, lateral movement, or deeper application compromise.

How to fix it

Upgrade affected Spring Framework applications and runtime images to fixed package versions where applicable. For the listed Chainguard packages, upgrade openjdk-11-openj9, openjdk-11-openj9-dbg, openjdk-11-openj9-default-jdk, openjdk-11-openj9-default-jvm, openjdk-11-openj9-default-policy, openjdk-11-openj9-doc, openjdk-11-openj9-jmods, and openjdk-11-openj9-jre to 0.53.0-r0 or later. Ensure applications are deployed on Servlet containers that comply with Servlet URI path canonicalization requirements and reject suspicious path sequences. Apache Tomcat and Eclipse Jetty are reported not vulnerable when their default security features remain enabled, so verify that URI normalization, encoded slash handling, and path rejection protections have not been weakened. Where immediate upgrade is not possible, mitigate by disabling Spring static resource handling for untrusted paths, moving static asset serving to a hardened web server or CDN that rejects traversal sequences, enforcing request normalization and rejection at a reverse proxy or WAF, and restricting filesystem permissions so the application process cannot read sensitive files unnecessarily.

How to confirm the fix worked

Confirm that all affected packages and application images have been rebuilt or redeployed with fixed versions, specifically Chainguard OpenJDK 11 OpenJ9 package version 0.53.0-r0 or later where those packages are used. Validate Servlet container configuration against Servlet URI path canonicalization requirements and confirm that suspicious sequences are rejected before reaching Spring resource handling. Test representative static resource URLs with encoded and unencoded traversal payloads and verify the response is a 400, 403, 404, or equivalent rejection rather than file disclosure. Review Spring MVC resource handler mappings to ensure they expose only intended locations and do not map broad filesystem paths. For Tomcat and Jetty deployments, verify default path normalization and encoded slash protections have not been disabled. In CI/CD, add regression tests that attempt traversal through static resource paths and fail the build if any file outside the configured static resource roots is returned.

Typical attack path

1. Identify internet-facing or accessible Spring MVC applications serving static content through Spring resource handling.
2. Fingerprint the web stack and determine whether the application is deployed as a WAR or with an embedded Servlet container.
3. Send benign traversal probes against static resource paths using sequences such as ../, ..%2f, %2e%2e%2f, or double-encoded variants.
4. Observe whether the application returns files outside the expected static resource directory or produces abnormal 200 responses, file contents, or distinctive error handling.
5. Enumerate likely sensitive files readable by the application process, including configuration files, dependency metadata, templates, keys, and packaged application resources.
6. Use any disclosed credentials, tokens, internal URLs, or application secrets for follow-on access or privilege expansion.

How to detect it

To determine whether exploitation has already occurred, review HTTP access logs from reverse proxies, load balancers, API gateways, WAFs, Servlet containers, and application logs for requests to static resource paths containing traversal sequences or encoded traversal variants. Focus on requests that returned HTTP 200, 206, or unusually large responses, as these may indicate successful file disclosure; 400, 403, and 404 responses are more consistent with blocked probing but should still be triaged for campaign activity. Search for access attempts targeting common sensitive files such as application configuration, YAML/properties files, packaged metadata, templates, certificates, private keys, environment files, or operating-system files. Correlate suspicious requests with source IPs that performed repeated encoding variations, directory-depth brute forcing, or requests across multiple static asset paths. Review WAF logs for path traversal rule matches and Servlet container logs for rejected or normalized URI warnings. If suspicious successful responses are found, inspect the exact response sizes, requested paths, application resource mappings, and any downstream authentication or credential use that occurred afterward. Because exploitation mainly results in file disclosure, endpoint artifacts may be limited; prioritize network and HTTP telemetry over host process indicators.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• ..%252f
• %252e%252e%252f
• %2e%2e%5c
• ..%5c
• %c0%ae%c0%ae%c0%af
• /WEB-INF/web.xml
• /WEB-INF/classes/application.properties
• /WEB-INF/classes/application.yml
• /WEB-INF/classes/application.yaml
• /META-INF/MANIFEST.MF
• /application.properties
• /application.yml
• /application.yaml
• /.env
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• /proc/1/environ
• BEGIN PRIVATE KEY
• server.tomcat.allow-encoded-slash
• allowEncodedSlash
• rejectIllegalHeader=false

What your security team should do

• Prioritize inventory of Spring MVC applications that serve static resources and are deployed as WAR files or with embedded Servlet containers, especially internet-facing services.
• Upgrade affected Chainguard OpenJDK 11 OpenJ9 packages to 0.53.0-r0 or later and rebuild dependent application images.
• Verify Servlet container hardening, including rejection of suspicious URI path sequences, encoded traversal, encoded slash, and double-encoded traversal attempts.
• Do not rely solely on default assumptions; explicitly check Tomcat, Jetty, and any alternative Servlet container configuration for disabled normalization or relaxed path handling.
• Add reverse proxy or WAF rules to block traversal payloads targeting static resource paths while upgrades are being completed.
• Review web access logs for historical traversal probes and successful 200 responses associated with suspicious path sequences.
• Rotate credentials or secrets if logs indicate files containing secrets may have been exposed.
• Reduce application filesystem read permissions and avoid packaging sensitive files inside deployable application artifacts.
• Add automated security tests for Spring static resource handlers to detect future traversal regressions.