CVE-2018-1273 VMware Tanzu Spring Data Commons Property Binder
Unauthenticated attackers can achieve remote code execution via crafted request parameters in Spring Data Commons property binding.
- Exploited in the wild
- Since 25 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1273?
CVE-2018-1273 is a critical code injection vulnerability in Spring Framework, published on 11 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Weakness: CWE-94
Which versions are affected by CVE-2018-1273?
4 open source packages ship an affected version, including org.springframework.data:spring-data-commons. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.data:spring-data-commons Maven | From 1.13.0 | 1.13.11 |
org.springframework.data:spring-data-commons Maven | From 1.13.0 | 1.13.11 |
org.springframework.data:spring-data-commons Maven | From 2.0.0 | 2.0.6 |
org.springframework.data:spring-data-commons Maven | From 2.0.0 | 2.0.6 |
Products include Apache Ignite, Broadcom Spring Data Commons, Oracle Financial Services Crime and Compliance Management Studio, Pivotal Software Spring Data Rest, Vmware Spring Data Rest.
How do I fix CVE-2018-1273?
Upgrade org.springframework.data:spring-data-commons to a fixed version for your release line: 1.13.11 or 2.0.6. US federal agencies must fix it by 15 Apr 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-1273 being exploited?
Yes. Attackers have exploited CVE-2018-1273 in the wild since at least 25 Mar 2022, including in ransomware campaigns.
Public exploit code: 1 Nuclei template and 7 proofs of concept on GitHub.
Other vulnerabilities in Spring Framework
- CVE-2018-8018 Code execution via deserialization in org.apache.ignite:ignite-core
- CVE-2018-1295 Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization
- CVE-2024-52577 Apache Ignite: Possible RCE when deserializing incoming messages by the server node
- CVE-2020-1963 File system access via H2 in Apache Ignite
- CVE-2025-48977 Apache Ignite: REST HTTP arbitrary file read vulnerability
Sources
Also known as GHSA-4fq3-mr56-cg6r.