CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Affected

Pivotal · Pivotal Spring Data REST and Spring Boot

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

74.53% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-20

Published

2018-01-04

Updated

2024-08-05

Proof-of-concept exploits (8)

• FixYourFace/SpringBreakPoC1★ · 2018-03-12
• cved-sources/cve-2017-80461★ · 2021-04-15
• guanjivip/CVE-2017-80460★ · 2020-08-01
• jkutner/spring-break-cve-2017-80461★ · 2018-04-16
• m3ssap0/SpringBreakVulnerableApp14★ · 2018-10-08
• m3ssap0/spring-break_cve-2017-804617★ · 2021-06-04
• sj/spring-data-rest-CVE-2017-80461★ · 2022-05-25
• bkhablenko/CVE-2017-80460★ · 2018-09-26

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8046.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/44289

Vulhub environments (1)

• vulhub/vulhub/tree/master/spring/CVE-2017-8046

Exploit collections (1)

• CVE-2017-8046.yamlzan8in/afrog

Security advisories

• https://pivotal.io/security/cve-2017-8046
• http://www.securityfocus.com/bid/100948
• advisories/GHSA-9qf9-28h9-hqcj

References

• CVE Record
• NVD entry

Related

• CVE-2015-8562
• CVE-2017-5638
• CVE-2018-6389
• CVE-2022-2884
• CVE-2022-46169
• CVE-2023-39362