Path Traversal in http4k ThymeleafTemplates

Executive Summary

This is a path traversal vulnerability in http4k versions before 6.62.0.0-ee affecting the ThymeleafTemplates component. It allows unauthenticated attackers to read arbitrary files outside the intended baseTemplateDir by supplying ../ segments in ViewModel.template() values. The issue occurs because Thymeleaf's FileTemplateResolver resolves escaped paths without proper containment checks, enabling attackers to manipulate template selection and access files readable by the server process.

Useful 0 Not Useful 0

Detection Guidance

Check http4k version with: mvn dependency:tree | grep http4k. If version is below 6.62.0.0-ee, the system is vulnerable. Inspect application logs for unusual template resolution attempts containing ../ segments in ViewModel.template() values.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive files on the server, such as configuration files, source code, or other confidential data accessible by the http4k process. This could lead to information disclosure, potential data breaches, or further attacks if credentials or keys are exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade http4k to version 6.62.0.0-ee or later immediately. If upgrading is not possible, implement path containment checks in ThymeleafTemplates similar to those in Pug4jTemplates to validate template paths before resolution.

Useful 0 Not Useful 0