spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator
    endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview
    before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to
    expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and
    a base folder (relative to the logging folder root) can be specified via request parameters. While the
    filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile`
    would not work), the base folder parameter was not sufficiently checked, so that
    `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability
    has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as
    there are no other changes in that release. There is no workaround to fix the vulnerability other than
    updating or removing the dependency. However, removing read access of the user the application is run with
    to any directory not required for running the application can limit the impact. Additionally, access to
    the logview endpoint can be limited by deploying the application behind a reverse proxy. (CVE-2021-21234)

Spring Boot Actuator Logview is a library that adds a simple logfile viewer as Spring Boot Actuator endpoint. In Spring Boot Actuator Logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (Spring Boot Actuator) HTTP endpoints. Both the filename to view and a base folder can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits, the base folder parameter was not sufficiently checked.

ID	Name	Product	Family	Type	Severity
417279	SCA: security update for eu.hinsch:spring-boot-actuator-logview (GHSA-p4q6-qxjx-8jgp)	Tenable Cloud Security	SCA Checks	Local	high
417279	SCA: security update for eu.hinsch:spring-boot-actuator-logview (GHSA-p4q6-qxjx-8jgp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
113197	Spring Boot Actuator Logview < 0.2.13 Directory Traversal	Web App Scanning	Component Vulnerability	Check Based	high

Detections

Analytics

CVE-2021-21234

high

Tenable Plugins

high

high

high