Introduction

The payloads for the path traversal CVE-2024-38816 are primarily debugged and analyzed on the Windows platform. However, when it comes to the Linux platform, there are some differences in path handling that can lead to traversal failures.

Vulnerability Location

It is primarily located under the routing configuration of the website.

WebConfig.class

// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)

package org.ota.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.FileSystemResource;
import org.springframework.web.reactive.function.server.RouterFunction;
import org.springframework.web.reactive.function.server.RouterFunctions;
import org.springframework.web.reactive.function.server.ServerResponse;

@Configuration
public class WebConfig {
    @Bean
    public RouterFunction<ServerResponse> route() {
        return RouterFunctions.resources("/static/**", new FileSystemResource("/app/static"));
    }
}

In summary, its function is to map resource requests under the /static route to the local folder directory /app/static for processing.

Path Handling Analysis on Windows

Vulnerability Analysis

Here we have two ways to locate the key processing class for the path.

Hindsight, directly diffing the fixed code can quickly locate the processing class.
Using backtrace frames, printing debug information, and other means to find the processing function.

Here, I hope to locate this vulnerability point from the perspective of vulnerability discovery.

Set a breakpoint in RouterFunctions.resources and proceed.

Analysis of Path Resolution Differences Between Windows and Linux Under CVE-2024-38816

Next, request a file that actually exists under /app/static to hit the breakpoint (the path I used is in the format of E:// Windows).

Backtrace frames locate the URL processing related class PathResourceLookupFunction

There is a clear handling of the path here, such as checking for the existence of .. or WEB-INF, etc.

Then set breakpoints on each method to see where the first request will go.

After the request, we can see that it reaches our apply function, and the parameter is our request, carrying the routing information we accessed.

First, look at the first part.

        PathContainer pathContainer = request.requestPath().pathWithinApplication();
        if (!this.pattern.matches(pathContainer)) {
            return Mono.empty();
        } else {
            pathContainer = this.pattern.extractPathWithinPattern(pathContainer);
            String path = this.processPath(pathContainer.value());

We extract the string after /static/1.txt to get /static/ and then process it using processPath.

    private String processPath(String path) {
        boolean slash = false;

        for(int i = 0; i < path.length(); ++i) {
            if (path.charAt(i) == '/') {
                slash = true;
            } elseif (path.charAt(i) > ' ' && path.charAt(i) != 127) {
                if (i != 0 && (i != 1 || !slash)) {
                    path = slash ? "/" + path.substring(i) : path.substring(i);
                    return path;
                }

                return path;
            }
        }

        return slash ? "/" : "";
    }

This processPath(String path) method can be summarized as: removing a string of invalid characters at the beginning of the path, keeping only the part starting from the first “valid character”, and adding a slash / in front (if there was a slash in the original path).

Logical Breakdown

Initialize slash = false. → Mark whether a slash has been encountered.

Iterate through each character of the string:

Case A: This character is not the first character, and the previous character is not a “single slash”. → If a slash has appeared before, prepend a slash to the result and then truncate the invalid part. → Otherwise, just truncate the invalid part directly.

Case B: This character is the first (or only one leading /). → Return the original string directly.

If a '/' is encountered → set slash = true (mark that a slash has appeared).

If a non-control character is encountered (> ' ' and not 127), it indicates this is the first “meaningful” character:

If the loop ends without finding a valid character:

If a slash has appeared, return "/"; otherwise return an empty string "".

After processing, we move to the second part, which is if our URL contains %, we perform url encoding on it.

            if (path.contains("%")) {
                path = StringUtils.uriDecode(path, StandardCharsets.UTF_8);
            }

Next, we look at the third part, which is the validation and reading part, meaning if it passes the StringUtils.hasLength(path) && !this.isInvalidPath(path) check, we associate it with our local file.

if (StringUtils.hasLength(path) && !this.isInvalidPath(path)) {
    try {
        Resource resource = this.location.createRelative(path);
        return resource.isReadable() && this.isResourceUnderLocation(resource) ? Mono.just(resource) : Mono.empty();
    } catch (IOException ex) {
        throw new UncheckedIOException(ex);
    }
}

First, let’s see how these two checks pass. First, hasLength can definitely pass, mainly the isInvalidPath, we want it to return false here.

    private boolean isInvalidPath(String path) {
        if (!path.contains("WEB-INF") && !path.contains("META-INF")) {
            if (path.contains(":/")) {
                String relativePath = path.charAt(0) == '/' ? path.substring(1) : path;
                if (ResourceUtils.isUrl(relativePath) || relativePath.startsWith("url:")) {
                    return true;
                }
            }

First, the string after /static/ cannot contain WEB-INF and META-INF, and then check if the first character is /, if so, remove it, or if it starts with various protocols like file://, http://, it gets banned, and there’s also a special case of url://

if (path.contains("..") && StringUtils.cleanPath(path).contains("../")) {
                return true;
            } else {
                return false;
            }

Finally, we check for directory traversal with .. and ../, but here the ../ check is done after a cleanPath processing, and the problem arises in this function.

    public static String cleanPath(String path) {
        if (!hasLength(path)) {
            return path;
        } else {
            String normalizedPath;
            if (path.indexOf(92) != -1) {
                normalizedPath = replace(path, "\\", "/");
                normalizedPath = replace(normalizedPath, "\\", "/");
            } else {
                normalizedPath = path;
            }

            String pathToUse = normalizedPath;
            if (normalizedPath.indexOf(46) == -1) {
                return normalizedPath;
            } else {
                int prefixIndex = normalizedPath.indexOf(58);
                String prefix = "";
                if (prefixIndex != -1) {
                    prefix = normalizedPath.substring(0, prefixIndex + 1);
                    if (prefix.contains("/")) {
                        prefix = "";
                    } else {
                        pathToUse = normalizedPath.substring(prefixIndex + 1);
                    }
                }

                if (pathToUse.startsWith("/")) {
                    prefix = prefix + "/";
                    pathToUse = pathToUse.substring(1);
                }

                String[] pathArray = delimitedListToStringArray(pathToUse, "/");
                Deque<String> pathElements = new ArrayDeque(pathArray.length);
                int tops = 0;

                for(int i = pathArray.length - 1; i >= 0; --i) {
                    String element = pathArray[i];
                    if (!".".equals(element)) {
                        if ("..".equals(element)) {
                            ++tops;
                        } elseif (tops > 0) {
                            --tops;
                        } else {
                            pathElements.addFirst(element);
                        }
                    }
                }

                if (pathArray.length == pathElements.size()) {
                    return normalizedPath;
                } else {
                    for(int i = 0; i < tops; ++i) {
                        pathElements.addFirst("..");
                    }

                    if (pathElements.size() == 1 && ((String)pathElements.getLast()).isEmpty() && !prefix.endsWith("/")) {
                        pathElements.addFirst(".");
                    }

                    String joined = collectionToDelimitedString(pathElements, "/");
                    return prefix.isEmpty() ? joined : prefix + joined;
                }
            }
        }
    }

Our main goal is to input a traversal path like ../ but after cleanPath it does not contain ../, and since this check is connected by &&, as long as the latter string processed by cleanPath does not contain ../, it can bypass.

The two main processing parts are:

The first part:

If \ or " is detected, it will be converted to /

            if (path.indexOf(92) != -1) {
                normalizedPath = replace(path, "\\", "/");
                normalizedPath = replace(normalizedPath, "\\", "/");
            } else {
                normalizedPath = path;
            }

The second part:

The main function is to deduplicate our path. For example, a path dog/cat/../aj actually represents dog/aj.

This part does exactly that.

String[] pathArray = delimitedListToStringArray(pathToUse, "/");
...
int prefixIndex = normalizedPath.indexOf(58);
                String prefix = "";
                if (prefixIndex != -1) {
                    prefix = normalizedPath.substring(0, prefixIndex + 1);
                    if (prefix.contains("/")) {
                        prefix = "";
                    } else {
                        pathToUse = normalizedPath.substring(prefixIndex + 1);
                    }
                }

                if (pathToUse.startsWith("/")) {
                    prefix = prefix + "/";
                    pathToUse = pathToUse.substring(1);
                }

                String[] pathArray = delimitedListToStringArray(pathToUse, "/");
                Deque<String> pathElements = new ArrayDeque(pathArray.length);
                int tops = 0;

                for(int i = pathArray.length - 1; i >= 0; --i) {
                    String element = pathArray[i];
                    if (!".".equals(element)) {
                        if ("..".equals(element)) {
                            ++tops;
                        } elseif (tops > 0) {
                            --tops;
                        } else {
                            pathElements.addFirst(element);
                        }
                    }
                }

                if (pathArray.length == pathElements.size()) {
                    return normalizedPath;
                } else {
                    for(int i = 0; i < tops; ++i) {
                        pathElements.addFirst("..");
                    }

                    if (pathElements.size() == 1 && ((String)pathElements.getLast()).isEmpty() && !prefix.endsWith("/")) {
                        pathElements.addFirst(".");
                    }
                }
...
String joined = collectionToDelimitedString(pathElements, "/");

First Bypass Method

Since dog/cat/../aj can be transformed into dog/aj, it means we have bypassed the ../, so the second condition will be judged as false, thus bypassing.

So how do we construct multiple ..?

Because this function delimitedListToStringArray will split our string by /, but empty characters will also be counted.

That is to say, a/// will be split into ['a','','',''], so we want to construct dog////cat/../../aj to make it become dog/aj, but due to the initial processPath processing, it will still not traverse out.

So we need to leverage the first part to convert \

Introduction

Vulnerability Location

Path Handling Analysis on Windows

Vulnerability Analysis

Logical Breakdown

First Bypass Method

Related posts

Leave a Comment Cancel reply