CVE-2020-5410

Spring Cloud Config's spring-cloud-config-server module (VMware/Pivotal/Tanzu) contains a directory traversal flaw that allows the config server to serve arbitrary configuration files from the underlying filesystem. An unauthenticated attacker triggers it by sending a request with a specially crafted URL containing path-traversal sequences to a vulnerable config server. Because the server resolves files outside the intended directory, the attacker gains the ability to read arbitrary files, including application configuration data and any credentials or secrets it references, with no integrity or availability impact. Anyone running Spring Cloud Config 2.2.x prior to 2.2.3, 2.1.x prior to 2.1.9, or older unsupported versions — including VMware Tanzu Spring Cloud Config Server deployments — is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2022-03-25 and carries a very high EPSS score (95.6%, 100th percentile).

What to do: Upgrade Spring Cloud Config to 2.2.3 or later (2.2.x line) or 2.1.9 or later (2.1.x line); older unsupported versions should move to a supported release, and VMware Tanzu Spring Cloud Services users should apply updates per vendor instructions. Until patched, restrict network reachability of config servers, require authentication on config endpoints where supported, and scan for internet-exposed instances, since exploitation requires no privileges or user interaction. Audit hosts running config servers for reads of sensitive local files, as the flaw allows unauthenticated arbitrary file disclosure.