CVE-2018-1273

What is Spring Data Commons?

Spring Data Commons is a foundational module of the Spring Data project, providing shared infrastructure — repository abstractions, query derivation, and property binding — used by nearly every Spring Data module (JPA, MongoDB, Redis, etc.). It underpins a huge share of Java enterprise web applications, meaning a flaw in its core binding logic has broad reach across the Spring ecosystem, including applications that never call Spring Data APIs directly but pull it in as a transitive dependency.

Overview

CVE-2018-1273 is a remote code execution vulnerability in how Spring Data Commons (and the related Spring Data REST) binds HTTP request parameters to Java objects. Specially crafted property names/paths submitted through standard web request parameters — for example, on registration or search forms exposed by Spring Data REST — can trigger evaluation of a Spring Expression Language (SpEL) expression, allowing an attacker to execute arbitrary code on the server.

Technical Details

The vulnerability (CWE-94, Code Injection) exists in the property path parsing used during data binding: when the framework evaluates nested/indexed property names (the "property binder"), maliciously constructed input can be interpreted as a SpEL expression rather than a literal property reference. Because Spring Data REST endpoints (and comparable data-binding entry points) are frequently exposed directly to the internet for user-facing forms, this gives an unauthenticated, remote attacker full code execution with a single HTTP request (CVSS 9.8: no auth, no user interaction, network vector, low complexity).

Discovery

The issue was found and reported through Pivotal Software's (now VMware Tanzu) responsible disclosure process for the Spring portfolio; Pivotal published a security advisory with patched versions of Spring Data Commons and Spring Data REST.

Exploitation Context

CISA's KEV listing confirms this vulnerability has been exploited in the wild, and its ransomware-use flag reflects its popularity as an initial-access vector against Spring-based enterprise applications — the ubiquity of Spring Data Commons as a transitive dependency means many organizations were unknowingly exposed even without directly using its REST features.

Remediation

1. Upgrade Spring Data Commons to the patched release line identified in Pivotal's advisory (Spring Data Commons 1.13 to 1.13.10, 2.0 to 2.0.5, or later), and update any Spring Data REST dependency in tandem.
2. Audit dependency trees (not just direct Maven/Gradle declarations) since Spring Data Commons is frequently pulled in transitively.
3. Restrict or disable Spring Data REST endpoints that are not intended for direct public exposure.
4. Deploy a web application firewall rule to detect SpEL injection patterns (T(, #this, getRuntime()) in request parameters as a stopgap.
5. Review application logs for unusual property-name parameters or unexpected outbound process execution from the application server.