CVE-2018-1273

CVE-2018-1273 is a property binder flaw (CWE-94, improper neutralization of special elements leading to code injection) in Spring Data Commons, affecting versions 1.13.0 to 1.13.10, 2.0.0 to 2.0.5, and older unsupported releases. An unauthenticated remote attacker triggers it by sending specially crafted request parameters against Spring Data REST-backed HTTP resources or via Spring Data projection-based request payload binding. Successful exploitation yields remote code execution on the application host, reflected in the critical CVSS 3.1 score of 9.8 with network attack vector and no privileges or user interaction required. Any application built on the affected library and exposing the vulnerable binding paths is at risk, including deployments of Spring Data REST, Apache Ignite, and Oracle Financial Services Crime and Compliance Management Studio that bundle the library. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2022-03-25 with known ransomware use, EPSS rates a 97% probability of exploitation within 30 days (100th percentile), and related threat reporting shows active attacks against Java-based services, although no public PoC is catalogued in the source data.

What to do: Apply vendor updates per the CISA KEV required action: upgrade Spring Data Commons past the last-affected releases 1.13.10 and 2.0.5 (i.e., 1.13.11 or 2.0.6 and later) or to the latest supported release. Inventory internet-facing Java applications for Spring Data REST endpoints and projection-based payload binding, patch or restrict those paths, and review application logs for exploitation activity given the known ransomware use.