Spring Data Commons up to 1.13.10/2.0.5 REST Endpoint Request resource management

Summaryinfo

A vulnerability identified as problematic has been detected in Spring Data Commons up to 1.13.10/2.0.5. The affected element is an unknown function of the component REST Endpoint. The manipulation as part of Request leads to resource management. This vulnerability is listed as CVE-2018-1274. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Spring Data Commons up to 1.13.10/2.0.5 and classified as problematic. This issue affects some unknown functionality of the component REST Endpoint. The manipulation as part of a Request leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is availability. The summary by CVE is:

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).

The bug was discovered 04/10/2018. The weakness was presented 04/18/2018 (Website). The advisory is shared at pivotal.io. The identification of this vulnerability is CVE-2018-1274 since 12/06/2017. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103769†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Spring Data Commons

Version

• 1.13.0
• 1.13.1
• 1.13.2
• 1.13.3
• 1.13.4
• 1.13.5
• 1.13.6
• 1.13.7
• 1.13.8
• 1.13.9
• 1.13.10
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion