Cloudanix VulnDB

CVE-2018-1273

Critical · 9.8 CISA KEV · ransomware

CVSS

9.8

EPSS

97.0%

Published

Apr 11, 2018

CISA due date

Apr 15, 2022

Cloudanix analysis

Act now SSVC: Act

Attackers can seize complete control of systems that use certain older versions of a popular data-handling library simply by sending crafted web requests.

Active In The Wild
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Full Compromise
Component
Library
Class
RCE
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Allows remote unauthenticated attackers to achieve arbitrary code execution by injecting malicious property bindings or SpEL expressions through Spring Data REST HTTP resources or projection-based payloads due to improper neutralization of special elements.

Why it matters to the business

Enables full system takeover, data exfiltration, and ransomware deployment across affected applications; high urgency due to confirmed use in ransomware campaigns and a past CISA remediation deadline.

How an attack unfolds

Threat actors identify exposed Spring Data REST endpoints and send crafted HTTP requests containing malicious property bindings that bypass neutralization, resulting in remote code execution; active exploitation observed in the wild including by ransomware operators.

How to fix it

Upgrade Spring Data Commons to 1.13.10, 2.0.5 or later supported releases; disable Spring Data REST or projection binding if immediate upgrade is impossible.

How to confirm the fix worked

Inventory all applications for vulnerable Spring Data Commons versions via dependency analysis or SBOM; confirm upgrade by verifying resolved versions and testing endpoint behavior with safe payloads.

Typical attack path

  1. Scan for publicly reachable Spring Data REST or projection endpoints
  2. Craft HTTP request parameters embedding SpEL expressions or unsafe property bindings
  3. Submit the payload to trigger deserialization or binding leading to code execution
  4. Establish shell access, deploy payloads, or move laterally

How to detect it

Examine web server and application logs for anomalous request parameters containing class references or executable expressions sent to REST resources; correlate with threat actor activity around Spring Data endpoints.

  • T(java.lang.Runtime)
  • java.lang.ProcessBuilder
  • new java.lang.ProcessBuilder
  • getRuntime().exec

What your security team should do

  • Prioritize patching all affected Spring Data Commons instances due to KEV and ransomware status
  • Block or monitor unauthenticated access to Spring Data REST endpoints
  • Implement WAF rules to detect SpEL-like patterns in request parameters
  • Review historical logs for exploitation attempts dating back to publication

The record

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Affected packages

Ecosystem Package Introduced Fixed
Maven org.springframework.data:spring-data-commons 1.13.0 1.13.11
Maven org.springframework.data:spring-data-commons 2.0.0 2.0.6
maven org.apache.ignite/ignite-core 1.0.0 No fix
maven org.springframework.data/spring-data-commons 1.13.RELEASE No fix
maven org.springframework.data/spring-data-commons 2.0.RELEASE No fix

Related vulnerabilities