Skip to content
Fencer Vulns
medium 4.8

CVE-2023-24815 json

Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web

published 2023-02-09 3 y ago modified 2026-09-10 1 mo ago also GHSA-53jx-vvf9-4x38 , EUVD-2023-0626

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return "/" + rest;` from `Utils.java` returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\` are not properly handled and an attacker can build a path that is valid within the classpath. This issue only affects users deploying in windows environments and upgrading is the advised remediation path. There are no known workarounds for this vulnerability.

Patch / fix

  • maven io.vertx:vertx-web 4.3.8
  • eclipse vert.x-web 4.3.8

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-24815 updated cvss 5.3

vertx-web: StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route

  • Red Hat build of Apicurio Registry 2 vertx-web Red Hat build of OptaPlanner 8 vertx-web Red Hat build of Quarkus vertx-web Red Hat Integration Camel K 1 vertx-web Red Hat Integration Camel Quarkus 2 vertx-web
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Application Runtimes vertx-web
    affected: no fix available
  • Red Hat Process Automation 7 vertx-web
    affected: no fix planned “Out of support scope”
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 2.4.0-2, cryostat-tech-preview/jfr-datasource-rhel8 2.4.0-2, cryostat-tech-preview/cryostat-reports-rhel8 2.4.0-2, cryostat-tech-preview/cryostat-rhel8-operator 2.4.0-3, cryostat-tech-preview/cryostat-operator-bundle 2.4.0-2, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8 2.4.0-2
    fixed: vendor fix RHSA-2023:7669
  • Red Hat RHINT Camel-Springboot 3.20.1.P1
    fixed: vendor fix RHSA-2023:3740
  • Red Hat A-MQ Clients 2 vertx-web Red Hat build of Debezium 1 vertx-web Red Hat Data Grid 8 vertx-web Red Hat Fuse 7 vertx-web Red Hat JBoss Data Grid 7 vertx-web Red Hat JBoss Enterprise Application Platform 7 vertx-web
    +3 more products
    Red Hat JBoss Enterprise Application Platform 8 vertx-web Red Hat JBoss Enterprise Application Platform Expansion Pack vertx-web Red Hat streams for Apache Kafka vertx-web
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/vert-x3/vertx-web/security/advisories/GHSA-53jx-vvf9-4x38 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven io.vertx:vertx-web
>=4.0.0, <4.3.8
4.3.8

Affected products

  • vert-x3 vertx-web

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.