⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2017-8046

Severity
9.8CRITICAL
EPSS
94.0%
top 0.11%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedJan 4
Latest updateMay 13

Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

CVEListV5pivotal/pivotal_spring_data_rest_and_spring_bootPivotal Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6
Mavenorg.springframework.data:spring-data-rest-core3.0.03.0.1.RELEASE+1
NVDvmware/spring_boot< 1.5.9+1

🔴Vulnerability Details

4
OSV
Remote code execution in PATCH requests in Spring Data REST2022-05-13
GHSA
Remote code execution in PATCH requests in Spring Data REST2022-05-13
CVEList
CVE-2017-8046: Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 22018-01-04
VulnCheck
VMware Spring Framework Improper Input Validation2017

💥Exploits & PoCs

2
Exploit-DB
Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution2018-03-15
Nuclei
Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

📋Vendor Advisories

1
Red Hat
spring-boot: Malicious PATCH requests submitted to servers can use specially crafted JSON data to run arbitrary Java code2018-03-06

💬Community

1
Bugzilla
CVE-2017-8046 spring-boot: Malicious PATCH requests submitted to servers can use specially crafted JSON data to run arbitrary Java code2018-03-08