Directory Traversal with spring-cloud-config-server (CVE-2020-5410)

What is affected, what to do

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

The vulnerability is being actively exploited; treat it as a priority. Update Spring Cloud Config to version 2.1.9, Spring Cloud Config to version 2.2.3. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Spring Cloud Config lt 2.1..2.1.9
• Spring Cloud Config lt 2.2..2.2.3

Fixed in

• Spring Cloud Config 2.1.9
• Spring Cloud Config 2.2.3

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade Spring Cloud Config Server to the fixed release: branch 2.2.x to 2.2.3 or later, branch 2.1.x to 2.1.9 or later. Unsupported branches (2.0.x, 1.x) have no backport — force migration to a supported minor line.
   • Audit build dependencies: scan Maven/Gradle manifests, SBOMs and Nexus/Artifactory for org.springframework.cloud:spring-cloud-config-server artifacts below 2.1.9 or 2.2.3, then trigger rebuild and redeploy of every consuming service.
   • Remove Config Server endpoints from the public internet: configure the reverse proxy or ingress so that /{application}/{profile} and /{application}/{profile}/{label}/** are only reachable from internal networks or the service mesh. Block TCP/8888 (the default) at the perimeter firewall.
   • Treat any secret stored in or referenced by the Config Server (Vault tokens, DB credentials, API keys inside application.yml, bootstrap.yml) as potentially leaked and rotate them, especially if the server was externally reachable before patching.
   • Retro-hunt 90 days of Config Server and upstream proxy access logs for traversal patterns (.., %2e%2e, %252e, encoded slashes). Treat any hit as a candidate secret-exposure incident.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: expose the Config Server only inside internal service VLANs. Allow traffic only from known Spring Boot clients via security groups, Kubernetes NetworkPolicy or mTLS inside a service mesh.
   • Enforce authentication: enable Spring Security in front of Config Server endpoints (spring.security.user.* or an OAuth2 Resource Server), minimum Basic Auth over HTTPS. Even without the patch this stops unauthenticated attackers from reaching the vulnerable URL handler.
   • WAF / reverse-proxy rule: block requests to the Config Server that contain .., %2e%2e, %2f%2e%2e, backslash variants or absolute paths (/etc/, C:\) in URI or query. Example Nginx: if ($request_uri ~* "(\.\.|%2e%2e|%252e)") { return 403; }.
   • Backend hardening: if the Config Server uses a local Git repo or filesystem backend, run the JVM as a non-root user and restrict it via AppArmor/SELinux or a read-only container rootfs scoped to the repo directory. This caps the blast radius even if traversal succeeds.
   • Secret hygiene: remove plaintext secrets from config repositories; migrate to HashiCorp Vault, Spring Cloud Config encryption ({cipher}) or an external KMS. A successful traversal then yields only ciphertext.
   • CI/CD gating: run dependency scanners (OWASP Dependency-Check, Dependabot, Renovate, Snyk) with fail-on-high so vulnerable Config Server versions cannot slip back into production.
3. 03

   Runbook step 3

   Detection rules

   • Access logs (reverse proxy, Spring Boot access.log): alert on requests to Config Server paths carrying traversal tokens. Sigma shape: selection: cs-uri-stem|contains: ['..','%2e%2e','%252e','..%2f','..%5c'] AND cs-host matches config-server FQDN.
   • Response-size baselining: oversized or MIME-atypical answers (text/plain, application/octet-stream) on Config endpoints that normally return JSON/YAML. KQL shape: AzureDiagnostics | where requestUri_s contains "config" | where responseSize_d > 100000.
   • Zeek/Suricata: signature on HTTP URIs with ../ or encoded variants combined with TCP/8888 or the Config Server SNI. Suricata shape: alert http any any -> $CONFIG_SERVER any (msg:"Spring Cloud Config path traversal CVE-2020-5410"; content:"../"; http_uri; sid:1000541;).
   • Host telemetry (auditd / Sysmon FileCreate, EID 11): the Config Server JVM process reading files outside the expected Git workspace, such as /etc/passwd, /root/, ~/.ssh/ or C:\Windows\. Any such read from this process is suspicious by itself.
   • SIEM correlation: a burst of 4xx/5xx responses from the Config Server followed by a single 200 with a large body from the same source IP — the classic fingerprint-then-exfiltrate pattern.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

Source: redhat_csaf, NVD (NIST), OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog

Vendors and products

• Spring By Vmware
• VMware Spring Cloud Config

Weakness classes (CWE)

• CWE-23Relative Path Traversal

  Base

  The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

  Entry at MITRE CWE-23

References & sources

• NVD (NIST)vuln/detail/CVE-2020-5410advisory
• github.comspring-cloud/spring-cloud-configpackage
• tanzu.vmware.comsecurity/cve-2020-5410web, x_refsource_CONFIRM, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410web, government-resource, US government resource