Description
攻击者可通过构造恶意HTTP请求访问服务器文件系统上的任意文件。该漏洞影响使用WebMvc.fn或WebFlux.fn提供静态资源的应用程序，若未正确处理路径参数，攻击者可绕过限制访问敏感文件。
Spring Framework路径遍历漏洞（CVE-2024-38819）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://spring.io/security/cve-2024-38819
https://nvd.nist.gov/vuln/detail/CVE-2024-38819
https://avd.aliyun.com/detail?id=AVD-2024-38819
https://www.secrss.com/articles/71343
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/framework/Spring-Framework-%E7%89%B9%E5%AE%9A%E6%9D%A1%E4%BB%B6%E4%B8%8B%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E-CVE-2024-38819.md
https://cloud.tencent.com/developer/article/2549737
https://springframework.org.cn/security/cve-2024-38819
https://www.anquanke.com/post/id/302773
https://blog.csdn.net/enthan809882/article/details/147120268
https://zhuanlan.zhihu.com/p/22106922733