CVE-2017-8046 in the critical feed json
Remote code execution in PATCH requests in Spring Data REST
published 2018-01-04 8 y ago modified 2026-06-26 4 mo ago also GHSA-9qf9-28h9-hqcj , EUVD-2022-3430
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 74.5%
- EPSS 74.5% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 1
- Exploit-DB, plus a Nuclei check
Summary
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Patch / fix
- maven org.springframework.data:spring-data-rest-core 2.6.9.RELEASE, 3.0.1.RELEASE
- vmware spring_boot 1.5.9
- vmware spring_data_rest 2.6.9
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-8046 updated cvss 10.0
spring-boot: Malicious PATCH requests submitted to servers can use specially crafted JSON data to run arbitrary Java code
-
Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R7fixed: vendor fix RHSA-2018:2405
-
Red Hat OpenShift Application Runtimes spring-bootnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- Published
- First public exploit (EDB-44289)
Exploit prediction
74.53% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-44289 Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution webapps, 2018-03-15
- Nuclei template Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.springframework.data:spring-data-rest-core | <2.6.9.RELEASE >=3.0.0, <3.0.1.RELEASE |
2.6.9.RELEASE 3.0.1.RELEASE |
Affected products
- Pivotal Pivotal Spring Data REST and Spring Boot
Classification
- Weakness
-
- CWE-20 Improper Input Validation
- Technology feeds
References
-
exploit-db.com
/exploits/44289/
exploit, third-party-advisory, vdb-entry
-
access.redhat.com
/errata/RHSA-2018:2405
vendor-advisory, web
-
pivotal.io
/security/cve-2017-8046
web, vendor-advisory
-
securityfocus.com
/bid/100948
vdb-entry, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-8046
advisory
-
github.com
/spring-projects/spring-data-rest/issues/1487
web
-
github.com
/spring-projects/spring-data-rest/issues/1520
web
-
bugzilla.redhat.com
/show_bug.cgi?id=1553024
web
-
github.com
/spring-projects/spring-data-rest
package
-
jira.spring.io
/browse/DATAREST-1127?redirect=false
web
Sources
- CVE List CVE-2017-8046
- GitHub Advisory GHSA-9qf9-28h9-hqcj
- NVD CVE-2017-8046
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.