Remote Code Execution Vulnerability in Spring Framework (CVE-2018-1270)
Summary
CVE-2018-1270: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the... Affects libspring-java across 2 version ranges.
< 4.3.19-1
< 8da0e46ff253bab5783713078eae8898708996ba
Fixed in 4.3.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a widely used application framework for Java that provides comprehensive infrastructure support for developing Java applications. It offers features such as dependency injection, aspect-oriented programming, and transaction management. This vulnerability affects versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15, allowing attackers to exploit STOMP over WebSocket endpoints, potentially leading to remote code execution.
Vulnerability Detail
CVE-2018-1270 is a critical vulnerability that allows malicious users to craft messages to an in-memory STOMP broker exposed by applications using the Spring Framework. This can lead to remote code execution, where an attacker can execute arbitrary code on the server, compromising the integrity and confidentiality of the application. The vulnerability arises from improper handling of STOMP messages, making it essential for developers to address it promptly.
How To Fix
Minimum fixed version
4.3.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider disabling STOMP over WebSocket endpoints in your application configuration to mitigate the risk until a proper fix can be applied. This can typically be done by modifying the application’s configuration files to restrict access to these endpoints.
Conclusion
CVE-2018-1270 is a significant vulnerability in the Spring Framework that can lead to remote code execution. It is crucial for developers to update their applications to secure versions and consider workarounds if immediate fixes are not feasible. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2018-1270 is a vulnerability in the Spring Framework that allows remote code execution through improperly handled STOMP messages.
Versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 are affected by this vulnerability.
You can use Vulert's playground to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-1270 is 9.8, indicating a critical level of severity.
If you cannot upgrade, disable STOMP over WebSocket endpoints in your application configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
