CVE-2020-5410

What is Spring Cloud Config Server?

Spring Cloud Config Server is a centralized configuration management service used by microservice architectures built on the Spring framework — instead of each service holding its own config files, they fetch configuration at startup from a central Config Server, often backed by a Git repository. Because it's designed to serve configuration files on request, path-handling bugs in that serving logic are directly exploitable for reading files the server shouldn't expose.

Overview

CVE-2020-5410 is a directory traversal vulnerability (CWE-23) in Spring Cloud Config Server. An application using the Config Server can be manipulated, via a specially crafted request, into serving arbitrary configuration files from the underlying filesystem rather than only the intended configuration set (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High).

Technical Details

The Config Server exposes an HTTP endpoint that resolves a requested configuration file's path based on client-supplied parameters (such as application name, profile, and label). Insufficient sanitization of these parameters allows an attacker to inject directory-traversal sequences that escape the intended configuration directory, reading files elsewhere on the server's filesystem — a class of bug with the same underlying shape as many other path traversal vulnerabilities covered on this site, applied here to a Spring-specific configuration-serving context.

Discovery

Reported through Spring's standard security disclosure process and fixed by VMware Tanzu (Spring's maintainer).

Exploitation Context

CISA added this CVE to KEV in March 2022 based on confirmed exploitation. Because Spring Cloud Config Server often runs with access to sensitive configuration data — database credentials, API keys, and other secrets for the microservices it configures — a directory traversal read primitive here can expose significantly more sensitive material than the bug's CVSS score alone might suggest.

Remediation

1. Update Spring Cloud Config Server to the patched version specified in VMware Tanzu's advisory immediately.
2. Restrict network access to the Config Server to only the microservices and administrators that need it; it should never be directly internet-facing.
3. Audit configuration files served by the Config Server for embedded secrets, and rotate any that may have been exposed if the instance was internet-facing and unpatched.
4. Review Config Server access logs for requests containing directory-traversal sequences in application name, profile, or label parameters.