CVE-2018-1270 Spring Framework allows applications to expose STOMP over WebSocket endpoints
Attackers can achieve remote code execution by sending crafted messages to STOMP over WebSocket endpoints in Spring Framework applications using the in-memory broker.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1270?
CVE-2018-1270 is a critical code injection vulnerability in Debian Debian Linux, published on 6 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
Which versions are affected by CVE-2018-1270?
4 open source packages ship an affected version, including org.springframework:spring-messaging. It affects 28 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework:spring-messaging Maven | All versions | 4.3.16.RELEASE |
org.springframework:spring-messaging Maven | All versions | 4.3.16.RELEASE |
org.springframework:spring-messaging Maven | From 5.0.0.RELEASE | 5.0.5.RELEASE |
org.springframework:spring-messaging Maven | From 5.0.0.RELEASE | 5.0.5.RELEASE |
Products include Debian Debian Linux, Oracle Application Testing Suite, Oracle Big Data Discovery, Oracle Communications Converged Application Server, Oracle Communications Diameter Signaling Router, Oracle Communications Performance Intelligence Center and 22 more.
How do I fix CVE-2018-1270?
Upgrade org.springframework:spring-messaging to a fixed version for your release line: 4.3.16.RELEASE or 5.0.5.RELEASE.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-1270 being exploited?
There is no known exploitation of CVE-2018-1270 in the wild and no public exploit code.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-1270, GHSA-p5hg-3xm3-gcjg, UBUNTU-CVE-2018-1270.