CVE-2018-1196: Vulnerability in org.springframework.boot:spring-boot
Summary
CVE-2018-1196: Moderate severity vulnerability that affects org.springframework.boot:spring-boot. Affects org.springframework.boot:spring-boot versions >= 1.5.0, < 1.5.10. Fixed in 1.5.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.springframework.boot:spring-boot package is a popular open-source framework for building Java applications. It provides a convenient way to create standalone, production-grade Spring-based applications. The package includes an embedded launch script that allows the application to be run as a systemd or init.d Linux service. This feature simplifies the deployment and management of Spring Boot applications on Linux systems.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1196, affects Spring Boot versions 1.5.9 and earlier, as well as versions 2.0.0.M1 through 2.0.0.M7. The embedded launch script included in these versions is susceptible to a symlink attack. This attack allows the 'run_user' to overwrite and take ownership of any file on the same system. However, it is important to note that the attack can only be instigated if the application is installed as a service and the 'run_user' has shell access to the server. Spring Boot applications that are not installed as services or do not use the embedded launch script are not vulnerable to this attack.
How To Fix
Minimum fixed version
1.5.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version of Spring Boot is not immediately feasible, a possible workaround is to avoid installing the application as a service or to use an alternative launch script that is not susceptible to symlink attacks. By not using the embedded launch script, the vulnerability can be mitigated. However, this workaround may require manual configuration and may not provide the same level of convenience as the embedded launch script.
Conclusion
In conclusion, the org.springframework.boot:spring-boot package is vulnerable to a symlink attack in its embedded launch script. This vulnerability can be mitigated by upgrading to a fixed version of Spring Boot or by avoiding the installation of the application as a service. It is recommended to take immediate action to ensure the security of your Spring Boot applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.springframework.boot:spring-boot →
FAQ
The vulnerability allows an attacker with shell access to the server and the ability to install the Spring Boot application as a service to overwrite and take ownership of any file on the system. This can lead to unauthorized access, data manipulation, or disruption of the system.
No, only versions 1.5.9 and earlier, as well as versions 2.0.0.M1 through 2.0.0.M7, are vulnerable to this symlink attack. Later versions have been patched to fix the vulnerability.
It is recommended to upgrade to a fixed version of Spring Boot as soon as possible to ensure the security of your application. However, if upgrading is not immediately feasible, you can mitigate the vulnerability by avoiding the installation of the application as a service or using an alternative launch script.
Yes, the vulnerability only affects Spring Boot applications that are installed as services and use the embedded launch script. If you don't install the application as a service or use an alternative launch script, your application will not be vulnerable to this attack.
You can find more information about the vulnerability, including its CVE identifier, in the GitHub Advisory Database. The provided link in the 'affected' section of this report will direct you to the specific advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.boot:spring-boot.
