CVE-2017-8046

CRITICAL9.8

ExploitHigh EPSS

Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

CVSS breakdown

CVSS 3.0

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

Pivotal / Pivotal Spring Data REST and Spring BootPivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 – Pivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6
pivotal_software / spring_data_rest3.0.0 – 3.0.0
pivotal_software / spring_data_rest3.0.0 – 3.0.0
pivotal_software / spring_data_rest3.0.0 – 3.0.0
pivotal_software / spring_data_rest3.0.0 – 3.0.0
pivotal_software / spring_data_rest3.0.0 – 3.0.0
VMware / spring_boot2.0.0 – 2.0.0
VMware / spring_boot2.0.0 – 2.0.0
VMware / spring_boot2.0.0 – 2.0.0
VMware / spring_boot2.0.0 – 2.0.0
VMware / spring_boot2.0.0 – 2.0.0
VMware / spring_boot1.5.9
VMware / spring_data_rest2.6.9
VMware / spring_data_rest3.0.0 – 3.0.0
VMware / spring_data_rest3.0.0 – 3.0.0
VMware / spring_data_rest3.0.0 – 3.0.0

Exploits & proofs of concept

exploit-dbSpring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Executionby Antonio Francesco Sardella
nucleiSpring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Executionby domwhewell-sage

References

MISChttps://pivotal.io/security/cve-2017-8046
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:2405
MISChttp://www.securityfocus.com/bid/100948
EXPLOIThttps://www.exploit-db.com/exploits/44289/

Updated 38m ago · 8 sources