A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- Fix
- Fixed in 5.2.20.RELEASE, 5.3.18, 2.5.12, 2.6.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Spring MVC and Spring WebFlux applications running on JDK 9 or later can be tricked into executing arbitrary code through their data binding feature. The known exploit specifically targets applications deployed as WAR files on Tomcat, while standard Spring Boot executable jars are not affected by that particular attack.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a Spring Framework
Spring Framework versions 5.3.X prior to 5.3.18+, 5.2.x prior to 5.2.20+ and all old and unsupported versions
- org.springframework:spring-beansMaven
fixed in 5.2.20.RELEASE
- org.springframework:spring-beansMaven
From 5.3.0 · fixed in 5.3.18
- org.springframework:spring-webmvcMaven
fixed in 5.2.20.RELEASE
- org.springframework:spring-webmvcMaven
From 5.3.0 · fixed in 5.3.18
- org.springframework.boot:spring-boot-starter-webMaven
fixed in 2.5.12
- org.springframework.boot:spring-boot-starter-webMaven
From 2.6.0 · fixed in 2.6.6
- org.springframework:spring-webfluxMaven
fixed in 5.2.20.RELEASE
- org.springframework:spring-webfluxMaven
From 5.3.0 · fixed in 5.3.18
- org.springframework.boot:spring-boot-starter-webfluxMaven
fixed in 2.5.12
- org.springframework.boot:spring-boot-starter-webfluxMaven
From 2.6.0 · fixed in 2.6.6