Aperçu
Spring Data Commons contains a remote code execution vulnerability in its property binder that allows unauthenticated attackers to execute arbitrary code by supplying crafted request parameters. The vulnerability exists in versions prior to 1.13.10, 2.0.5, and all older unsupported versions. La vulnérabilité a été divulguée le April 11, 2018. CISA a identifié CVE-2018-1273 comme étant exploitée et est connue pour être utilisée dans des campagnes de rançongiciel.
Détails techniques
Spring Data Commons exposes a property binder that improperly neutralizes special elements in request parameters. An unauthenticated attacker can craft malicious request parameters containing Spring Expression Language (SpEL) payloads that are evaluated by the framework, leading to arbitrary code execution on the server. The vulnerability affects any application using Spring Data Commons without proper input validation or expression language sandboxing.
La vulnérabilité est classifiée comme CWE-917 (Expression Language Injection) etCWE-94 (Improper Control of Generation of Code ('Code Injection')) .
La vulnérabilité a reçu un score de base CVSS v3.1 de 9.8 (CRITICAL) avec la chaîne vectorielle CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indiquant sa nature critical.
Impact
An unauthenticated attacker can execute arbitrary code with the privileges of the application server, potentially leading to complete system compromise. This includes data theft, malware installation, lateral movement within the network, and denial of service.
Mitigation et contournements
Update Spring Data Commons dependency to version 1.13.10, 2.0.5, or later. For Maven projects, update the dependency in pom.xml: <version>2.0.5.RELEASE</version> or later. For Gradle projects, update build.gradle: 'org.springframework.data:spring-data-commons:2.0.5.RELEASE' or later. After updating dependencies, rebuild and redeploy the application. Les versions suivantes incluent les correctifs nécessaires : Spring Data Commons 1.13.10+, Spring Data Commons 2.0.5+, Spring Data Commons 2.1.0+.
Comme contournements temporaires : implement strict input validation for all request parameters, rejecting any parameters containing special characters or spel syntax patterns (${...}, t(...), etc.); disable automatic binding of request parameters and explicitly whitelist which parameters can be bound to model objects, et use spring security to restrict access to vulnerable endpoints and implement request filtering to block parameters containing spel expressions.
Recommandation de CISA : Apply updates per vendor instructions.
Ressources additionnelles
Source : Ce rapport a été généré par IA
