9.8crit
CVE-2017-8046in critical feed1 exploitNuclei template
Remote code execution in PATCH requests in Spring Data REST
Also known as GHSA-9qf9-28h9-hqcj
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
74.5%
percentile 99%
Public exploits
1
Exploit-DB · Nuclei check
Summary
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Exploit prediction (EPSS)
74.53% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- Nuclei template Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution · nuclei detection template
- EDB-44289 Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution · webapps · 2018-03-15
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.data:spring-data-rest-core | <2.6.9.RELEASE >=3.0.0, <3.0.1.RELEASE | 2.6.9.RELEASE 3.0.1.RELEASE |
Affected products
- Pivotal Pivotal Spring Data REST and Spring Boot
Classification
- Weakness
- CWE-20 Improper Input Validation
- Technology feeds
- Spring (RSS, critical only)
References
- pivotal.io /security/cve-2017-8046 · x_refsource_CONFIRM, x_transferred
- access.redhat.com /errata/RHSA-2018:2405 · vendor-advisory, x_refsource_REDHAT, x_transferred
- securityfocus.com /bid/100948 · vdb-entry, x_refsource_BID, x_transferred
- exploit-db.com /exploits/44289/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-8046 · advisory
- github.com /spring-projects/spring-data-rest/issues/1487 · web
- github.com /spring-projects/spring-data-rest/issues/1520 · web
- bugzilla.redhat.com /show_bug.cgi?id=1553024 · web
- github.com /spring-projects/spring-data-rest · package
- jira.spring.io /browse/DATAREST-1127?redirect=false · web
Sources
- CVE List: CVE-2017-8046
- GitHub Advisory: GHSA-9qf9-28h9-hqcj
- NVD: CVE-2017-8046
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.