CVE-2017-8046

Vulnerability

CVE-2017-8046 is a remote code execution vulnerability in Spring Data REST versions prior to 2.6.9 (Ingalls SR9) and versions prior to 3.0.1 (Kay SR1), as well as in Spring Boot versions prior to 1.5.9 and 2.0 M6 [2]. The vulnerability is triggered when a server receives maliciously crafted PATCH requests containing specially crafted JSON data. This flaw allows attackers to execute arbitrary Java code on the affected server.

Exploitation

An attacker must have network access to the vulnerable server and be able to send HTTP PATCH requests to a Spring Data REST endpoint [2]. The attacker crafts a JSON payload that, when processed by the vulnerable Spring Data REST component, leads to arbitrary code execution. No authentication is required for exploitation, as the vulnerability can be triggered by unauthenticated PATCH requests to publicly exposed repository resources [2].

Impact

Successful exploitation of CVE-2017-8046 allows an attacker to execute arbitrary Java code on the affected server [2]. The attacker can run code in the context of the application, potentially leading to full compromise of the server, including disclosure of sensitive data, modification or destruction of data, and further lateral movement within the network [2]. The vulnerability is rated with a CVSS base score indicating a critical severity level [4].

Mitigation

This vulnerability is fixed in Spring Data REST versions 2.6.9 (Ingalls SR9) and 3.0.1 (Kay SR1), and in Spring Boot versions 1.5.9 and 2.0 M6 [2]. Users of affected versions should upgrade immediately. Red Hat also released an update as RHSA-2018:2405 for Red Hat FIS 2.0 on Fuse 6.3.0 R7 to remediate this issue [4]. No workarounds have been publicly disclosed, and upgrading to the fixed versions is the primary mitigation. This CVE is not listed on the CISA KEV catalog at the time of writing.