CVE-2020-5410
VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
Description
CVE-2020-5410 is a critical directory traversal vulnerability in VMware Tanzu Spring Cloud Config Server that allows unauthenticated attackers to read arbitrary files from the server's filesystem via specially crafted HTTP requests. The flaw exists in how Spring Cloud Config Server processes URL path parameters, enabling path traversal sequences to escape the intended configuration directory. CISA has confirmed active exploitation and added CVE-2020-5410 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 94.3% (99.9th percentile), this vulnerability represents a high-severity threat to organizations using Spring Cloud Config Server for centralized application configuration management.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | spring cloud config | >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://tanzu.vmware.com/security/cve-2020-5410(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 describes a weakness where software uses external input to construct a pathname intended to identify a file within a restricted directory, but fails to properly neutralize path traversal sequences such as "../" that can resolve to locations outside the restricted directory. In CVE-2020-5410, Spring Cloud Config Server fails to properly validate URL path parameters, allowing an attacker to use directory traversal sequences to access arbitrary files on the underlying filesystem.
Learn more: CWE-22 — Path Traversal
Impact Analysis
CVE-2020-5410 enables unauthenticated remote attackers to read arbitrary files from the server hosting Spring Cloud Config Server, which can lead to the exposure of highly sensitive information. Config servers typically store database credentials, API keys, encryption secrets, and service-to-service authentication tokens used across an entire microservices architecture. Successful exploitation can therefore provide attackers with the keys to compromise multiple downstream systems and services simultaneously. Beyond configuration files, attackers can read system files such as /etc/passwd, SSH keys, and application source code, enabling further attack vectors. The EPSS score of 94.3% (99.9th percentile) confirms that this vulnerability is under widespread active exploitation, and its position in centralized configuration infrastructure amplifies the blast radius of any successful attack.
Exploit Maturity
CVE-2020-5410 is actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities catalog. Public proof-of-concept exploit code is widely available, and the exploitation technique is straightforward — requiring only a crafted HTTP GET request with directory traversal sequences in the URL path. The EPSS score of 94.3% (99.9th percentile) reflects near-certain exploitation activity, consistent with the low barrier to exploitation and the high value of credentials and secrets typically stored in Spring Cloud Config Server deployments.
Remediation
- Upgrade Spring Cloud Config Server to a patched version immediately: version 2.2.3 or later for the 2.2.x branch, or version 2.1.9 or later for the 2.1.x branch, as required by the CISA KEV directive.
- If immediate patching is not possible, restrict network access to the Spring Cloud Config Server to only trusted internal services and ensure it is not accessible from the public internet.
- Rotate all credentials, API keys, database passwords, and secrets stored in or managed by the affected Spring Cloud Config Server, as they may have been exposed prior to patching.
- Review access logs for the Config Server for unusual requests containing path traversal patterns (e.g., "../", "%2e%2e%2f") that may indicate exploitation attempts or successful data exfiltration.
- Implement defense-in-depth by encrypting sensitive values in configuration properties, enabling Spring Cloud Config Server's built-in encryption features, and deploying a web application firewall to detect and block path traversal attacks.
Technical Details
CVE-2020-5410 is a directory traversal vulnerability (CWE-22) in VMware Tanzu Spring Cloud Config Server. The vulnerability exists in the way the server processes URL path parameters when serving configuration files. By sending an HTTP GET request with specially crafted path traversal sequences in the URL, an attacker can escape the intended configuration directory and read arbitrary files from the server's filesystem. The attack does not require authentication and can be performed with a single HTTP request. Spring Cloud Config Server versions 2.2.x before 2.2.3 and 2.1.x before 2.1.9 are affected. Since Spring Cloud Config Server is commonly deployed as a centralized configuration service in microservices architectures, it often has access to sensitive credentials and secrets for multiple services, making it a high-value target for attackers.
Frequently Asked Questions
Is CVE-2020-5410 being actively exploited?
Yes, CVE-2020-5410 is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is freely available, and the EPSS score of 94.3% (99.9th percentile) confirms extremely high exploitation activity. Any exposed Spring Cloud Config Server running a vulnerable version should be considered at immediate risk.
What products are affected by CVE-2020-5410?
CVE-2020-5410 affects VMware Tanzu Spring Cloud Config Server versions 2.2.x before 2.2.3 and 2.1.x before 2.1.9. Any application using these versions of Spring Cloud Config Server to serve configuration files is vulnerable to arbitrary file read via directory traversal.
How do I fix CVE-2020-5410?
Upgrade Spring Cloud Config Server to version 2.2.3 or later (for 2.2.x) or version 2.1.9 or later (for 2.1.x). After patching, rotate all secrets and credentials managed by the Config Server, as they may have been exposed. If immediate patching is not possible, restrict network access to the Config Server.
How severe is CVE-2020-5410?
CVE-2020-5410 is rated CRITICAL as it enables unauthenticated arbitrary file read on the Config Server. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation. Since Config Servers store credentials for entire microservices ecosystems, a successful exploit can cascade into the compromise of numerous downstream services and databases.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.