CVE-2018-1275 Spring Framework has Improperly Implemented Security Check for Standard

Critical 9.8 Published 11 Apr 2018 Updated 17 Sep 2024

Attackers can achieve remote code execution by sending crafted messages to STOMP over WebSocket endpoints in Spring Framework applications using the spring-messaging module.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-1275?

CVE-2018-1275 is a critical code injection vulnerability in Oracle Application Testing Suite, published on 11 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.

Weakness: CWE-358, CWE-94

Which versions are affected by CVE-2018-1275?

4 open source packages ship an affected version, including org.springframework:spring-messaging. It affects 19 products.

Package	Affected	Fixed in
`org.springframework:spring-messaging` Maven	All versions	`4.3.16.RELEASE`
`org.springframework:spring-messaging` Maven	All versions	`4.3.16.RELEASE`
`org.springframework:spring-messaging` Maven	From `5.0.0.RELEASE`	`5.0.5.RELEASE`
`org.springframework:spring-messaging` Maven	From `5.0.0.RELEASE`	`5.0.5.RELEASE`

Products include Oracle Application Testing Suite, Oracle Big Data Discovery, Oracle Communications Converged Application Server, Oracle Communications Diameter Signaling Router, Oracle Communications Performance Intelligence Center, Oracle Communications Services Gatekeeper and 13 more.

How do I fix CVE-2018-1275?

Upgrade org.springframework:spring-messaging to a fixed version for your release line: 4.3.16.RELEASE or 5.0.5.RELEASE.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-1275 being exploited?

There is no known exploitation of CVE-2018-1275 in the wild and no public exploit code.

All Oracle Application Testing Suite vulnerabilities

Sources

Also known as GHSA-3rmv-2pg5-xvqj.