Description

The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-26T18:16:33.050Z",
  "pubdate": "2026-08-26T18:16:33.050Z",
  "executiveSummary": "A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists within the Spring Cloud Config Server's SVN repository management functionality.\nThe vulnerability pertains to how the application handles the directory specified by 'spring.cloud.config.server.svn.basedir' during SVN repository cloning operations.\nThis flaw allows an attacker to potentially manipulate the state of the base directory between the time the application validates the environment and the time it executes the clone or update operation.\nImpact includes potential unauthorized access to, or modification of, sensitive configuration data stored within the SVN repository structure.\nAffected products include Spring Cloud Config versions 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier.\nExploitation requires an attacker to have local or logical access to the filesystem where the base directory resides, enabling the orchestration of race conditions during the SVN synchronization lifecycle.\nThe risk implication is significant for environments relying on SVN for sensitive configuration management, as it undermines the integrity and confidentiality of the injected application properties.",
  "technicalDetails": "The root cause of the vulnerability lies in an insecure sequence of filesystem operations performed by the Spring Cloud Config Server when interfacing with Subversion (SVN) repositories. Specifically, the component responsible for maintaining the local working copy—defined by the configuration property 'spring.cloud.config.server.svn.basedir'—performs a series of checks (e.g., verifying directory existence, accessibility, or permissions) followed by an action (e.g., performing 'svn checkout' or 'svn update').\nIn a TOCTOU (Time-of-Check Time-of-Use) scenario, there is a race condition window between the check operation and the actual execution of the SVN command. An attacker with the ability to influence the filesystem state within the defined 'basedir' can exploit this temporal gap. By replacing a directory, file, or symbolic link immediately after the application has validated the path but before the SVN client performs the write operation, the attacker can cause the process to act on an unintended target.\nThe attack flow proceeds as follows: First, the attacker identifies the predictable or known location of the 'basedir'. Second, the attacker monitors the application for SVN synchronization triggers. Third, the attacker utilizes filesystem primitives or race-condition orchestration tools to swap the legitimate directory structure for a malicious symlink or a different file entity precisely during the narrow window between the application's verification logic and the 'svn' binary execution.\nIf successfully exploited, the SVN client process—which may run with the privileges of the service user—could be directed to write configuration data into an unauthorized location, overwrite critical system files, or read arbitrary files if the process can be coerced into operating on an attacker-controlled path. This behavior essentially hijacks the file-writing capabilities of the SVN integration.\nThis vulnerability is particularly concerning as it does not necessarily require direct network-level exploitation of the Spring Cloud Config API, but rather leverages the underlying operating system's filesystem interactions. The affected versions include Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, and 3.1.14 and earlier. The severity is dependent on the OS-level permissions of the service account and the ability of an adversary to manipulate the filesystem path allocated to the SVN base directory."
}