CVE-2024-23673: Apache Sling Path Traversal Vulnerability

CVE-2024-23673 Overview

CVE-2024-23673 is a path traversal vulnerability [CWE-22] in Apache Sling Servlets Resolver that can lead to malicious code execution. The flaw affects all versions of Apache Sling Servlets Resolver before 2.11.0. Exploitability depends on the runtime configuration of the deployment.

An authenticated user with write access to the repository can trick the Sling Servlet Resolver into loading a previously uploaded script. This turns write access into a script execution primitive on the server. The Apache Sling project recommends upgrading to version 2.11.0 regardless of whether a given configuration currently allows exploitation.

Critical Impact
A repository user with write privileges can achieve server-side code execution by uploading a script and coercing the Sling Servlet Resolver to load it through path traversal.

Affected Products

Apache Sling Servlets Resolver versions prior to 2.11.0
Apache Sling deployments where system configuration permits script resolution from user-writable repository paths
Downstream products embedding vulnerable Sling Servlets Resolver builds

Discovery Timeline

2024-02-06 - CVE-2024-23673 published to NVD
2024-02-06 - Apache Sling security thread and Openwall OSS-Security disclosure published
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23673

Vulnerability Analysis

Apache Sling resolves incoming HTTP requests to servlets and scripts stored in a JCR (Java Content Repository). The Servlets Resolver component determines which script backs a given resource type and request selectors. Prior to version 2.11.0, this resolution process did not adequately sanitize path segments used to locate scripts.

An attacker with write access to the repository can place a script at a path that, when combined with traversal sequences during resolution, points the resolver to attacker-controlled content. When the resolver loads and executes the referenced script, arbitrary code runs in the context of the Sling application. The flaw is categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The root cause is insufficient validation of script paths during servlet and script resolution. The resolver accepted path components that could traverse outside the intended script search locations. Combined with permissive repository ACLs, this allowed a low-privileged authenticated user to influence which script the server executes for a given request.

Attack Vector

Exploitation requires network access to the Sling instance and authenticated write access to the JCR repository. The attacker first uploads a malicious script to a location they can write to. They then issue a crafted HTTP request whose selectors, extensions, or resource type coerce the Servlets Resolver into loading the uploaded script. The attack complexity is elevated because it depends on the specific repository ACL configuration and script resolution rules of the target deployment.

No verified proof-of-concept code is publicly available. See the Apache Sling security thread and the Openwall OSS-Security discussion for the vendor's technical description.

Detection Methods for CVE-2024-23673

Indicators of Compromise

Unexpected script files (.jsp, .esp, .ecma, .html with server-side scripting) written to JCR paths outside standard /apps and /libs locations
HTTP requests containing path traversal sequences such as ../ in resource type or selector components targeting Sling endpoints
Sling access log entries showing script resolution to user-writable repository paths like /content/ or /tmp/
New or modified nodes with sling:resourceType or sling:resourceSuperType properties pointing to non-standard locations

Detection Strategies

Audit JCR repository content for scripts residing outside sanctioned application directories
Inspect Sling request logs for anomalous selectors, extensions, or resource type values containing traversal characters
Correlate authenticated write operations to the repository with subsequent script execution events
Review the org.apache.sling.servlets.resolver bundle version deployed on each Sling instance and flag any below 2.11.0

Monitoring Recommendations

Enable verbose logging on the Sling Servlets Resolver to record script resolution decisions during triage
Alert on repository writes to executable script types by non-administrative accounts
Monitor for outbound network connections initiated by the Sling JVM immediately following script uploads
Track process creation events spawned by the Sling application server as a signal of code execution

How to Mitigate CVE-2024-23673

Immediate Actions Required

Upgrade Apache Sling Servlets Resolver to version 2.11.0 or later on all instances
Audit repository ACLs and remove write access from accounts that do not require it
Review existing repository content for unauthorized scripts and remove them
Restrict script resolution paths to trusted application directories such as /apps and /libs

Patch Information

Apache Sling addressed the vulnerability in org.apache.sling.servlets.resolver version 2.11.0. The vendor recommends upgrading regardless of whether the current configuration is believed to be exploitable. Consult the Apache Sling security thread for release details and upgrade guidance.

Workarounds

Tighten JCR ACLs so that non-administrative users cannot create nodes with executable script resource types
Configure the Servlets Resolver Execution Paths to a strict allowlist under /apps and /libs
Place a reverse proxy in front of Sling that blocks requests containing ../ sequences in path, selector, or extension components
Disable write access to production repositories from anonymous and low-privileged accounts until patching completes

bash

# Configuration example: restrict Sling Servlets Resolver execution paths
# File: org.apache.sling.servlets.resolver.SlingServletResolver.config
servletresolver.paths=["/apps","/libs"]
servletresolver.defaultExtensions=["html"]