CVE-2023-29337

What it actually does

Remote code execution flaw in the NuGet client that permits an attacker to run arbitrary code on the target system when specific conditions for network access, privileges, and user interaction are met.

Why it matters to the business

Attackers could gain full control of affected systems leading to data theft, service disruption, or further network compromise; the issue has low exploitation likelihood, has not appeared in ransomware campaigns, and carries no CISA remediation deadline.

How an attack unfolds

An attacker supplies a malicious NuGet package or repository response that the client processes; due to the high attack complexity and requirement for authenticated access plus user interaction, the payload executes code on the victim system.

How to fix it

Upgrade org.springframework.kafka/spring-kafka to version 2.9.11 or 3.0.10 or later; apply the fixed versions listed for the affected Maven artifact.

How to confirm the fix worked

Confirm the installed package version is at or above 2.9.11 or 3.0.10; re-run package restore operations in a test environment to verify no unexpected code paths are triggered.

Typical attack path

1. Identify a reachable NuGet client instance with the vulnerable version
2. Craft and host a malicious package or feed response
3. Trick an authenticated user into performing a package operation that triggers the flaw
4. Execute arbitrary code on the target system

How to detect it

Search package management logs and NuGet client activity for unexpected package sources or operations; examine process execution logs around package restore events for anomalous child processes.

What your security team should do

• Prioritize upgrade of org.springframework.kafka/spring-kafka to 2.9.11 or 3.0.10 within standard change windows given low EPSS and no KEV listing
• Review NuGet client usage across the environment for any remaining vulnerable instances
• Monitor EPSS trend for any future increase