Remote code execution in PATCH requests in Spring Data REST

CRITICAL 9.8CVE-2017-8046 · GHSA-9qf9-28h9-hqcj · Published 04/01/2018 · updated 26/06/2026

Package	Affected versions	Patched versions
org.springframework.data:spring-data-rest-core Maven	`≥ 3.0.0, < 3.0.1.RELEASE< 2.6.9.RELEASE`	`3.0.1.RELEASE2.6.9.RELEASE`
spring data rest pivotal_software	`= 3.0.0`	No fix yet
spring boot vmware	`= 2.0.0< 1.5.9`	`1.5.9`
spring data rest vmware	`= 3.0.0< 2.6.9`	`2.6.9`

Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) can use specially crafted JSON data to run arbitrary Java code.

NVD description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

References

nvd.nist.gov/vuln/detail/CVE-2017-8046 · ADVISORY
spring-projects/spring-data-rest · WEB
spring-projects/spring-data-rest · WEB
access.redhat.com/errata/RHSA-2018:2405 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
spring-projects/spring-data-rest · PACKAGE
jira.spring.io/browse/DATAREST-1127 · WEB
pivotal.io/security/cve-2017-8046 · WEB
securityfocus.com/bid/100948 · Third Party Advisory
exploit-db.com/exploits/44289 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free