CVE-2024-37084: Spring Cloud Data Flow RCE Vulnerability

CVE-2024-37084 Overview

CVE-2024-37084 is an arbitrary file write vulnerability affecting Spring Cloud Data Flow versions prior to 2.11.4. The flaw resides in the Skipper server API upload handler. An authenticated attacker with access to the Skipper server API can send a crafted upload request that writes a file to any location on the underlying file system. Successful exploitation can lead to full server compromise, including remote code execution when attackers overwrite executable content or scheduled tasks. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code and is documented in the Spring Security Advisory CVE-2024-37084.

Critical Impact
Authenticated attackers can write arbitrary files to any file system location accessible to the Skipper server process, enabling remote code execution and full host compromise.

Affected Products

VMware Spring Cloud Data Flow versions prior to 2.11.4
Spring Cloud Skipper server component (bundled with Spring Cloud Data Flow)
Deployments exposing the Skipper API to authenticated users

Discovery Timeline

2024-07-25 - CVE-2024-37084 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37084

Vulnerability Analysis

Spring Cloud Data Flow orchestrates data pipelines and delegates package management to the Skipper server. Skipper accepts package uploads through its REST API to register and deploy application artifacts. The upload endpoint fails to validate or sanitize file path components supplied by the client. An attacker with valid Skipper API credentials can therefore direct the server to place attacker-controlled bytes at any file system path the Java process can write to.

The EPSS score of 35.2% places this issue in the 98th percentile of vulnerabilities most likely to be exploited, reflecting the low complexity of abusing an authenticated upload primitive.

Root Cause

The root cause is improper input validation on file path metadata during package upload processing in the Skipper server. The handler concatenates or resolves user-supplied path fragments without enforcing that the resulting canonical path stays inside the intended package storage directory. This design allows classic path traversal sequences to escape the target directory during upload.

Attack Vector

Exploitation requires network access to the Skipper API and low-privileged authenticated credentials. The attacker submits a crafted upload request containing directory traversal segments in the filename or path fields. The Skipper server resolves the path and writes the request body to the attacker-chosen destination. Attackers commonly target locations such as web application deployment directories, cron configuration files, SSH authorized_keys, or startup scripts to achieve code execution as the Skipper service account.

No public proof-of-concept exploit code has been published for this vulnerability. Refer to the Spring Security Advisory CVE-2024-37084 for vendor-supplied technical detail.

Detection Methods for CVE-2024-37084

Indicators of Compromise

Skipper server access logs showing POST requests to the package upload endpoint containing ../ sequences or absolute paths in filename parameters
Unexpected files appearing outside the configured Skipper package directory, particularly in web roots, /etc/, or user home directories
New or modified files owned by the Skipper service account in system startup, cron, or SSH configuration paths
Outbound network connections initiated by the Spring Cloud Data Flow JVM to unrecognized destinations following upload activity

Detection Strategies

Review Skipper API audit logs for upload requests with traversal patterns, non-standard file extensions, or unusually large payloads
Correlate authenticated Skipper user sessions with file creation events on the host to identify writes outside expected package directories
Baseline the file system paths written by the Spring Cloud Data Flow process and alert on writes to sensitive directories
Monitor Java process behavior for child process spawns that follow upload API calls

Monitoring Recommendations

Enable verbose access logging on the Skipper HTTP endpoints and forward logs to a centralized analytics platform
Deploy file integrity monitoring on system directories that the Skipper service account can reach
Alert on any Skipper API authentication from IP addresses outside the expected management network

How to Mitigate CVE-2024-37084

Immediate Actions Required

Upgrade Spring Cloud Data Flow to version 2.11.4 or later on all Skipper server instances
Rotate credentials for all accounts with access to the Skipper API and review recent upload activity
Restrict network access to the Skipper API to trusted administrative networks and identity-aware proxies
Run the Skipper server under a dedicated low-privilege service account with a restrictive file system umask

Patch Information

VMware released the fix in Spring Cloud Data Flow 2.11.4. Administrators should follow the guidance in the Spring Security Advisory CVE-2024-37084 and validate that both the Data Flow and bundled Skipper components are updated. After patching, audit stored packages and file system paths for artifacts written before remediation.

Workarounds

Disable or firewall the Skipper API if immediate patching is not feasible
Enforce strong authentication and role-based access control on the Skipper server, granting upload rights only to trusted operators
Run the Spring Cloud Data Flow stack inside a container with a read-only root file system and a narrowly scoped writable volume for package storage

bash

# Configuration example: restrict Skipper API access with a firewall rule
# Allow only the management subnet to reach the Skipper server port
iptables -A INPUT -p tcp --dport 7577 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7577 -j DROP

# Run the Skipper service under a dedicated non-root account
useradd --system --shell /usr/sbin/nologin skipper
chown -R skipper:skipper /opt/spring-cloud-skipper