Description

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.2",
  "pubDate": "2026-08-27T20:17:55.347Z",
  "pubdate": "2026-08-27T20:17:55.347Z",
  "executiveSummary": "Spring Integration's PropertiesPersistingMetadataStore is vulnerable to an information disclosure vulnerability due to insecure file system permissions.\nThe component, which serves as the default file-based ConcurrentMetadataStore, persists application state to a predictable path within the system's temporary directory.\nThe generated metadata file is configured with world-readable permissions by default, allowing unauthorized local users or processes on the same host to access sensitive persistent metadata.\nThis vulnerability affects Spring Integration versions 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and 5.5.21 and earlier.\nThe risk implication is that sensitive information stored within the metadata store—such as sequence IDs, message identifiers, or potentially sensitive configuration keys—may be exposed to non-privileged local actors.\nExploitation requires local access to the file system where the application is running, allowing an attacker to read the contents of the properties file without requiring elevated privileges.",
  "technicalDetails": "The root cause of this vulnerability lies in the default configuration and directory handling of the PropertiesPersistingMetadataStore component within Spring Integration. This component is responsible for persisting metadata to the file system using the path '${java.io.tmpdir}/spring-integration/metadata-store.properties'.\nIn multi-user environments, the system temporary directory (e.g., /tmp on Unix-like systems) is globally accessible. By default, files created in these directories without explicit permission restrictions inherit the default umask of the process, which often permits read access by other local users on the host system.\nThe attack flow is straightforward: an attacker with local user access on the server hosting the Spring Integration application monitors the standard temporary file path. Upon the application initializing and persisting metadata, the attacker reads the world-readable 'metadata-store.properties' file.\nThe 'PropertiesPersistingMetadataStore' does not implement restrictive 'java.io.File' or 'java.nio.file.Files' permission flags (such as POSIX file attributes to restrict access to the file owner) during the file creation or initialization process. Consequently, the operating system defaults to creating the file with '644' permissions, allowing read access for the group and 'others' (world-readable).\nThe impact includes the exposure of stateful metadata that the application assumes is protected by the host OS. Depending on the specific use case, this metadata may contain sensitive sequence information or internal identifiers that could be leveraged for further attacks, such as cross-protocol session hijacking, replay attacks, or providing reconnaissance data regarding the internal state of the integration flow.\nThe vulnerability affects multiple versions: Spring Integration 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and 5.5.21 and earlier. No authentication is required for the local attacker beyond local shell access to the host. The exposure is limited to the local file system; however, on shared hosting environments or containerized environments where multiple processes share a volume or temporary partition, this presents a significant security risk to confidentiality of application state."
}