CVE-2018-1196
published 2018-03-19CVE-2018-1196: Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with…
PriorityP428medium5.9CVSS 3.0
AVNACHPRNUINSUCNIHAN
EPSS
1.23%
65.6th percentile
Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "run_user" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the "run_user" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dell_emc | spring_boot | — | — |
| dell_emc | spring_boot | — | — |
| vmware | spring_boot | <= 1.5.9 | — |
| vmware | spring_boot | — | — |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Moderate severity vulnerability that affects org.springframework.boot:spring-boot
ghsa·2018-10-18
CVE-2018-1196 [MEDIUM] CWE-59 Moderate severity vulnerability that affects org.springframework.boot:spring-boot
Moderate severity vulnerability that affects org.springframework.boot:spring-boot
Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "run_user" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the "run_user" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.
OSV
Moderate severity vulnerability that affects org.springframework.boot:spring-boot
osv·2018-10-18
CVE-2018-1196 [MEDIUM] Moderate severity vulnerability that affects org.springframework.boot:spring-boot
Moderate severity vulnerability that affects org.springframework.boot:spring-boot
Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "run_user" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the "run_user" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.
Red Hat
Boot: Symlink privilege escalation attack via launch script
vendor_redhat·2018-01-30·CVSS 5.9
CVE-2018-1196 [MEDIUM] CWE-59 Boot: Symlink privilege escalation attack via launch script
Boot: Symlink privilege escalation attack via launch script
Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "run_user" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the "run_user" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.
Package: spring-boot (Red Hat JBoss Fuse 6) - Not affected
Package: spring-boot (Red Hat OpenShift Application Runtimes) - Not aff
No detection rules found.
No public exploits indexed.
2018-03-19
Published