critical9.8Public exploit code
CVE-2017-8046
Remote code execution in PATCH requests in Spring Data REST
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution2018-03-15 · webapps · java
Impact
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) can use specially crafted JSON data to run arbitrary Java code.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.data:spring-data-rest-core | < 2.6.9.RELEASE | 2.6.9.RELEASE |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Boot | before 1.5.9 Version 2.0.0 |
| Pivotal Software | Spring Data Rest | Version 3.0.0 |
| Vmware | Spring Data Rest | before 2.6.9 Version 3.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/100948
- https://access.redhat.com/errata/RHSA-2018:2405
- https://pivotal.io/security/cve-2017-8046
- https://www.exploit-db.com/exploits/44289/
- https://github.com/advisories/GHSA-9qf9-28h9-hqcj
- https://nvd.nist.gov/vuln/detail/CVE-2017-8046
- https://github.com/spring-projects/spring-data-rest/issues/1487
- https://github.com/spring-projects/spring-data-rest/issues/1520
- https://bugzilla.redhat.com/show_bug.cgi?id=1553024
- https://jira.spring.io/browse/DATAREST-1127?redirect=false