Skip to content
Fencer Vulns
medium 5.1

CVE-2024-23639 json

micronaut-core management endpoints vulnerable to drive-by localhost attack

published 2024-02-09 2 y ago modified 2026-09-10 1 mo ago also GHSA-583g-g682-crxf , EUVD-2024-0520

cvss
5.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits
0
none known

Summary

Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought. A malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are "simple" and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered. Production environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development. This issue has been addressed in version 3.8.3. Users are advised to upgrade.

Patch / fix

  • maven io.micronaut:micronaut-http-server 3.8.3
  • maven io.micronaut:micronaut-http-server-netty 3.8.3
  • maven io.micronaut:micronaut-http-server-tck 3.8.3
  • objectcomputing micronaut 3.8.3

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
maven io.micronaut:micronaut-http-server
<3.8.3
3.8.3
maven io.micronaut:micronaut-http-server-netty
<3.8.3
3.8.3
maven io.micronaut:micronaut-http-server-tck
<3.8.3
3.8.3

Affected products

  • micronaut-projects micronaut-core

Classification

Weakness
  • CWE-15 External Control of System or Configuration Setting
  • CWE-664 Improper Control of a Resource Through its Lifetime
  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.