CVE-2018-1273
VMware Tanzu Spring Data Commons Property Binder Vulnerability
Description
CVE-2018-1273 is a critical remote code execution vulnerability in VMware Tanzu Spring Data Commons that allows unauthenticated attackers to execute arbitrary code on the server through a specially crafted request to a Spring Data REST-backed HTTP resource. The vulnerability exists in the property binder mechanism, which improperly handles user-supplied property names, enabling code injection via SpEL (Spring Expression Language) evaluation. CISA has confirmed active exploitation and added CVE-2018-1273 to the Known Exploited Vulnerabilities catalog, and it is a confirmed ransomware attack vector. With an EPSS score of 94.3% (99.9th percentile), CVE-2018-1273 represents one of the most critical Spring Framework vulnerabilities ever disclosed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| broadcom | spring data commons | <= 1.12.10; >= 1.13.0, <= 1.13.10; >= 2.0.0, <= 2.0.5 |
| pivotal software | spring data rest | >= 3.0.0, <= 3.0.5 |
| vmware | spring data rest | <= 2.5.10; >= 2.6.0, <= 2.6.10 |
| apache | ignite | >= 1.0.1, <= 2.5.0; 1.0.0 |
| oracle | financial services crime and compliance management studio | 8.0.8.2.0; 8.0.8.3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E(Mailing List, Third Party Advisory)
- https://pivotal.io/security/cve-2018-1273(Vendor Advisory)
- https://www.oracle.com/security-alerts/cpujul2022.html(Patch, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1273(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-94 describes a weakness where software constructs code segments using externally-influenced input without properly neutralizing special elements that could alter the intended code syntax or behavior. In CVE-2018-1273, the Spring Data Commons property binder evaluates user-supplied property names as Spring Expression Language (SpEL) expressions, allowing an attacker to inject and execute arbitrary Java code on the server through crafted HTTP request parameters.
Learn more: CWE-94 — Code Injection
Impact Analysis
CVE-2018-1273 enables unauthenticated remote code execution on any application using vulnerable versions of Spring Data Commons with Spring Data REST endpoints exposed. The vulnerability allows attackers to execute arbitrary Java code on the server, granting full control over the affected application and potentially the underlying server. Applications built on the Spring Framework are ubiquitous in enterprise environments, powering web applications, APIs, and microservices across virtually every industry sector. A successful exploit can lead to complete server compromise, data exfiltration, lateral movement within the network, and deployment of ransomware or other malware. The confirmed use in ransomware campaigns combined with the EPSS score of 94.3% (99.9th percentile) makes CVE-2018-1273 an emergency-priority vulnerability for all affected deployments.
Exploit Maturity
CVE-2018-1273 is actively exploited in the wild and is confirmed as a ransomware attack vector by CISA. Public exploit code is widely available, including proof-of-concept demonstrations that show how to achieve remote code execution through a single HTTP POST request with crafted property names. The EPSS score of 94.3% (99.9th percentile) reflects near-certain exploitation probability. The widespread use of Spring Data in enterprise Java applications means the potential attack surface is enormous, and automated exploitation tools targeting this vulnerability are actively used by threat actors.
Remediation
- Upgrade Spring Data Commons immediately to version 1.13.11, 2.0.6, or later as applicable, and update Spring Data REST and Spring Boot to versions that include the patched Spring Data Commons dependency.
- If immediate patching is not possible, implement a web application firewall (WAF) rule to block HTTP requests containing SpEL injection patterns in parameter names, particularly those containing expressions like "__" or SpEL syntax markers.
- Audit all applications in your environment for Spring Data Commons and Spring Data REST dependencies to identify the complete scope of affected systems.
- Review application logs for suspicious requests with unusual property names or parameter patterns that may indicate exploitation attempts, and check for signs of post-exploitation activity.
- Implement defense-in-depth by running Spring applications with minimal system privileges, enabling Java Security Manager where possible, and deploying runtime application self-protection (RASP) to detect and prevent code injection attacks.
Technical Details
CVE-2018-1273 is a code injection vulnerability (CWE-94) in the property binder mechanism of Spring Data Commons, which is used by Spring Data REST to bind HTTP request parameters to domain object properties. The vulnerability exists because the property binder evaluates property names supplied in HTTP requests as Spring Expression Language (SpEL) expressions. An attacker can craft an HTTP POST request with specially constructed parameter names that contain SpEL expressions, which are then evaluated by the server, enabling execution of arbitrary Java code. The attack requires no authentication and can be executed with a single HTTP request to any Spring Data REST-backed endpoint. Spring Data Commons versions 1.13.x before 1.13.11 and 2.0.x before 2.0.6 are affected. The vulnerability is also present in Spring Data REST and Spring Boot applications that depend on the vulnerable Spring Data Commons versions.
Frequently Asked Questions
Is CVE-2018-1273 being actively exploited?
Yes, CVE-2018-1273 is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog as a confirmed ransomware attack vector. Public exploit code is freely available, and the EPSS score of 94.3% (99.9th percentile) confirms near-certain exploitation activity. Any application using vulnerable Spring Data Commons with exposed REST endpoints is at immediate risk.
What products are affected by CVE-2018-1273?
CVE-2018-1273 affects VMware Tanzu Spring Data Commons versions 1.13.x before 1.13.11 and 2.0.x before 2.0.6. Spring Data REST, Spring Boot, and any application depending on the vulnerable Spring Data Commons library are also affected. The vulnerability impacts Java applications built using the Spring Data framework.
How do I fix CVE-2018-1273?
Upgrade Spring Data Commons to version 1.13.11, 2.0.6, or later. Update all dependent Spring Data REST and Spring Boot versions accordingly. Audit all Java applications in your environment for vulnerable Spring Data dependencies. If immediate patching is not possible, deploy WAF rules to block SpEL injection patterns in HTTP request parameters.
How severe is CVE-2018-1273?
CVE-2018-1273 is rated CRITICAL as it enables unauthenticated remote code execution through a single HTTP request. It is a confirmed ransomware delivery mechanism. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation. The ubiquity of Spring Framework in enterprise Java applications makes this vulnerability's potential blast radius exceptionally large.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.