Read the docs
TI-2023-10315 Aliases CVE-2023-24815GHSA-53jx-vvf9-4x38

Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web

Priority MEDIUM 57CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return "/" + rest;` from `Utils.java` returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\` are not properly handled and an attacker can build a path that is valid within the classpath. This issue only affects users deploying in windows environments and upgrading is the advised remediation path. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00919 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial vertx-web (vert-x3): 4.3.8io.vertx:vertx-web (Maven): 4.3.8Red Hat: 2 advisoriesRed Hat: 2 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vert-x3vertx-web4.0.0 to before 4.3.84.3.8Patch availableCNA
—io.vertx:vertx-web (Maven)4.0.0 to before 4.3.84.3.8Patch availableGHSA-53jx-vvf9-4x38
  • vertx-web Vendorvert-x3 Affected 4.0.0 to before 4.3.8 Fixed in 4.3.8 Patch available CNA
  • io.vertx:vertx-web (Maven) Vendor— Affected 4.0.0 to before 4.3.8 Fixed in 4.3.8 Patch available GHSA-53jx-vvf9-4x38

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:vert.x-web:*:*:*:*:*:*:*:*4.0.0 to before 4.3.8VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:vert.x-web:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.3.8 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · CNA vertx-web (vert-x3) Fixed in 4.3.8
  • Fix · GHSA-53jx-vvf9-4x38 io.vertx:vertx-web (Maven) Fixed in 4.3.8 Advisory →

Red Hat 2 advisories

  • RHSA-2023:7669 Released 2023-12-06 · Red Hat rating Moderate
    Red Hat build of Cryostat 2.4.0: new RHEL 8 container images
    • Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
  • RHSA-2023:3740 Released 2023-06-21 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.20.1 Patch 1 release security update
    • RHINT Camel-Springboot 3.20.1.P1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 2AffectedNo fix planned: Will not fix
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix planned: Will not fix
Cryostat 2 on RHEL 8Fixed RHSA-2023:7669
RHINT Camel-Springboot 3.20.1.P1Fixed RHSA-2023:3740
Not affected: 9 products
  • A-MQ Clients 2
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of Debezium 1
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-24815
  2. 2026-10-03 Alias added: GHSA-53jx-vvf9-4x38

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-00756 Eclipse Vert.x Web static handler file access denial CVSS 4.0MEDIUM 6.9
  • TI-2020-17897 Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences