The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator (%2F) lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources that should not be public.
On Windows, a similar attack exists with (%5C).
// impactDisclosure of classpath or webjar resources outside the configured base.
// preconditions- Application uses ResourceService (with a non-root base path) or WebjarService
- At least one classpath entry is served from a directory (e.g. sbt run, exploded .war)
- Backend forwards %2F/%5C without normalizing (e.g., Ember, Blaze)
The patch rejects any decoded path segment containing / (%2F) or \ (%5C) with a 400 Bad Request in ResourceService and WebjarService.
FileService was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization.
// workarounds- Deploy as a fat jar, with no filesystem directories on the classpath.
- Front the service with a proxy that rejects/normalizes %2F and %5C in the request path.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None