Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

CVE-2021-21234 — AI Deep Analysis Summary

CVSS 7.7 · High

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A **Directory Traversal** flaw in `spring-boot-actuator-logview`.…

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE-22**: Improper Limitation of a Pathname to a Restricted Directory. 🐛 **Flaw**: The `filename` parameter is sanitized, but the `base` parameter is **not** checked.…

Q3Who is affected? (Versions/Components)

👥 **Vendor**: Lukashinsch (Ffay). 📦 **Product**: `spring-boot-actuator-logview`. 📉 **Affected Versions**: **< 0.2.13**. ✅ **Fixed**: Version 0.2.13 and later are safe.

Q4What can hackers do? (Privileges/Data)

🕵️ **Hackers Can**: Read arbitrary files on the server. 📄 **Data Access**: Logs, config files, source code, or secrets located outside the log root.…

Q5Is exploitation threshold high? (Auth/Config)

⚠️ **Threshold**: Medium. 🔑 **Auth**: Requires **Local Privileges** (PR:L) to access the Actuator endpoint initially. 🌐 **Network**: Remote (AV:N). 🖱️ **UI**: None required (UI:N). ⚡ **Complexity**: Low (AC:L).

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔍 **Public Exp?**: Yes. 📂 **PoCs Available**: Multiple GitHub repos (e.g., PwCNO-CTO, xiaojiangxl) and Nuclei templates exist. 🌍 **Wild Exploitation**: Possible if the endpoint is exposed and accessible.

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check**: Look for the Maven package `eu.hinsch:spring-boot-actuator-logview`. 📋 **Version**: Check if version is < 0.2.13. 🧪 **Test**: Send request with `base=../` to the logview endpoint.…

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Official Fix**: Yes. 📦 **Patch**: Upgrade to **version 0.2.13** or higher. 🔄 **Action**: Update the dependency in your `pom.xml` or `build.gradle`. No other code changes needed.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. 🗑️ Remove the dependency if not needed. 2. 🚫 Restrict file system permissions (remove read access for the app user). 3.…

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **High Priority** for affected users. 📅 **Published**: Jan 2021. ⚖️ **Risk**: CVSS 7.5 (High).…