Path Traversal in Spring Integration

Executive Summary

This vulnerability is a path traversal issue in Spring Integration's ZipTransformer. An attacker who can set the file_name header on a message can manipulate the resulting .zip archive to be written to any filesystem path outside the configured workDirectory. This happens because the file_name header is used to construct the workDirectory path when ZipResultType.FILE is set, which is the default setting.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Spring Integration version is within the affected ranges (6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, or 7.1.0). Verify if ZipTransformer with ZipResultType.FILE is used and if file_name headers are processed. Inspect logs for unexpected file writes outside the workDirectory.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write malicious .zip files to arbitrary locations on the filesystem. This could lead to unauthorized file creation, overwriting existing files, or placing files in sensitive directories. The impact depends on the permissions of the application running Spring Integration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file writes outside intended directories. An attacker exploiting this could place sensitive data in unintended locations, risking data leaks or unauthorized access. This may violate principles of data integrity, confidentiality, and controlled access required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to fixed versions: 7.1.0.1 (Enterprise Support only), 7.1.1 (OSS), 7.0.5.1 (Enterprise Support only), 7.0.6 (OSS), 6.5.11 (Enterprise Support only), or 6.4.13 (Enterprise Support only). No additional mitigation steps are required beyond upgrading.

Useful 0 Not Useful 0