{"id":"GHSA-583g-g682-crxf","summary":"Micronaut management endpoints vulnerable to drive-by localhost attack","details":"### Summary\nEnabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical of a production application, these attacks may have more impact on a development environment where such endpoints may be flipped on without much thought.\n\n### Details\nA malicious/compromised website can make HTTP requests to `localhost`. Normally, such requests would trigger a CORS preflight check which would prevent the request; however, some requests are [\"simple\"](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests) and do not require a preflight check. These endpoints, if enabled and not secured, are vulnerable to being triggered.\n\n### Impact\nProduction environments typically disable unused endpoints and secure/restrict access to needed endpoints. A more likely victim is the developer in their local development host, who has enabled endpoints without security for the sake of easing development.\n","aliases":["CVE-2024-23639"],"modified":"2026-08-24T00:35:43.951612168Z","published":"2024-02-09T15:19:15Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-02-09T15:19:15Z","nvd_published_at":"2024-02-09T01:15:09Z","cwe_ids":["CWE-15","CWE-610","CWE-664"]},"references":[{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-583g-g682-crxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23639"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/pull/8642"},{"type":"WEB","url":"https://github.com/micronaut-projects/micronaut-core/commit/01adb21e57137caaf7004313d2055c5a78b1f47b"},{"type":"WEB","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests"},{"type":"PACKAGE","url":"https://github.com/micronaut-projects/micronaut-core"}],"affected":[{"package":{"name":"io.micronaut:micronaut-http-server","ecosystem":"Maven","purl":"pkg:maven/io.micronaut/micronaut-http-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3"}]}],"versions":["1.0.0","1.0.0.RC3","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.1.0.M1","1.1.0.M2","1.1.0.RC1","1.1.0.RC2","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.0.RC1","1.2.0.RC2","1.2.1","1.2.10","1.2.11","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.0.M1","1.3.0.M2","1.3.0.RC1","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","2.0.0","2.0.0.M1","2.0.0.M2","2.0.0.M3","2.0.0.RC1","2.0.0.RC2","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","3.0.0","3.0.0-M1","3.0.0-M2","3.0.0-M3","3.0.0-M4","3.0.0-M5","3.0.0-RC1","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.3.0","3.3.0-M1","3.3.1","3.3.2","3.3.3","3.3.4","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.8.0","3.8.1","3.8.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-583g-g682-crxf/GHSA-583g-g682-crxf.json"}},{"package":{"name":"io.micronaut:micronaut-http-server-netty","ecosystem":"Maven","purl":"pkg:maven/io.micronaut/micronaut-http-server-netty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3"}]}],"versions":["1.0.0","1.0.0.RC3","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.1.0","1.1.0.M1","1.1.0.M2","1.1.0.RC1","1.1.0.RC2","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.0.RC1","1.2.0.RC2","1.2.1","1.2.10","1.2.11","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.0.M1","1.3.0.M2","1.3.0.RC1","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","2.0.0","2.0.0.M1","2.0.0.M2","2.0.0.M3","2.0.0.RC1","2.0.0.RC2","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","3.0.0","3.0.0-M1","3.0.0-M2","3.0.0-M3","3.0.0-M4","3.0.0-M5","3.0.0-RC1","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.3.0","3.3.0-M1","3.3.1","3.3.2","3.3.3","3.3.4","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.8.0","3.8.1","3.8.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-583g-g682-crxf/GHSA-583g-g682-crxf.json"}},{"package":{"name":"io.micronaut:micronaut-http-server-tck","ecosystem":"Maven","purl":"pkg:maven/io.micronaut/micronaut-http-server-tck"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3"}]}],"versions":["3.8.0","3.8.1","3.8.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-583g-g682-crxf/GHSA-583g-g682-crxf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}