Description

Malicious PATCH requests submitted to servers using Spring Data REST backed HTTP resources can use specially crafted JSON data to run arbitrary Java code.

Affected Spring Products and Versions

• Spring Data REST versions prior to 2.6.9 (Ingalls SR9), 3.0.1 (Kay SR1)
• Spring Boot (if Spring Data REST module is used) versions prior to 1.5.9, 2.0 M6

Mitigation

Users of affected versions should apply the following mitigation:

• Releases that have fixed this issue include:
  • Spring Data REST 2.6.9 (Ingalls SR9, Oct. 27th, 2017)
  • Spring Data REST 3.0.1 (Kay SR1, Oct. 27th 2017)
  • Spring Boot 1.5.9 (Oct, 28th 2017)
  • Spring Boot 2.0 M6 (Nov. 6th 2017)

Credit

This vulnerability was responsibly reported by Man Yue Mo from Semmle and lgtm.com.

References

• https://jira.spring.io/browse/DATAREST-1127
• https://jira.spring.io/browse/DATAREST-1152

History

2017-09-21: Initial vulnerability report published

• 2018-03-06: Corrected affected and fixed versions