PT-2018-10922 · Spring · Spring Boot

Adam Stephens · Published 2018-03-19 · Updated 2022-04-07 · CVE-2018-1196

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Boot versions 1.5.9 and earlier Spring Boot versions 2.0.0.M1 through 2.0.0.M7

Description The issue allows the run user to overwrite and take ownership of any file on the same system due to a symlink attack. This can happen when the application is installed as a service and the run user has shell access to the server. Applications not installed as a service or not using the embedded launch script are not affected.

Recommendations For Spring Boot versions 1.5.9 and earlier, update to a version later than 1.5.9 to resolve the issue. For Spring Boot versions 2.0.0.M1 through 2.0.0.M7, update to a version later than 2.0.0.M7 to resolve the issue. As a temporary workaround, consider restricting shell access to the server for the run user to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2018-1196

GHSA-XX65-CC7G-9PFP

Affected Products

Spring Boot

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1196 · Security Note
• https://pivotal.io/security/cve-2018-1196 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1196 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xx65-cc7g-9pfp · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1196 · Note
• https://github.com/advisories/GHSA-xx65-cc7g-9pfp · Note