CriticalPublic exploit

Spring Data REST PATCH Remote Code Execution

IdentifiersCVE-2017-8046CWE-94

CVE-2017-8046 is a code-injection vulnerability in Spring Data REST's handling of PATCH requests. A remote attacker can submit specially crafted JSON in a PATCH request to a server running a vulnerable Spring Data REST version, causing arbitrary Java code to execute. Affected versions include Spring Data REST releases before 2.6.9.RELEASE in the 2.6.x line and before 3.0.1.RELEASE in the 3.0.x line; affected Spring Boot releases include versions before 1.5.9 and 2.0.0.M6.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation permits remote execution of arbitrary Java code in the security context of the vulnerable Spring application. This can lead to complete compromise of the affected application, including access to application data and resources available to its service account.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure of endpoints that accept PATCH requests, especially externally reachable Spring Data REST resources. Restrict network access to affected services, disable or filter PATCH where operationally feasible, and place compensating controls such as authentication, authorization hardening, and request inspection in front of exposed REST endpoints until upgrades are completed. No specific vendor workaround is otherwise available.

Remediation

Patch, then assume compromise.

Upgrade Spring Data REST to 2.6.9.RELEASE or later for the 2.6.x release line, or 3.0.1.RELEASE or later for the 3.0.x release line. For applications consuming the affected dependency through Spring Boot, upgrade to Spring Boot 1.5.9 or later, or 2.0.0.M6 or later in the applicable release stream, and ensure the resolved Spring Data REST dependency contains the fix.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).

VALID 1 / 3 TOTALView more in app

spring-break_cve-2017-8046MaturityOperationalVerified exploit

This repository contains a Java-based exploit for CVE-2017-8046, a remote code execution vulnerability in Pivotal Spring Data REST (and related Spring Boot/Data versions). The exploit is implemented in a single Java file (SpringBreakCve20178046.java) and is designed to send malicious PATCH requests with specially crafted JSON payloads to vulnerable endpoints. The payload leverages Spring Expression Language (SpEL) injection to execute arbitrary system commands or upload files to the server. The exploit supports options for specifying the target URL, command to execute, file to upload, custom headers, cookies, and SSL validation skipping. The README provides detailed usage instructions, example commands, and a list of example vulnerable endpoints. The repository is structured as a Maven project, with a pom.xml for dependencies and build configuration. The exploit is operational and can be used to achieve RCE or file upload on vulnerable Java-based web applications using affected Spring Data REST versions.

m3ssap0Disclosed Mar 9, 2018javaxmlnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

BroadcomSpring Bootapplication

BroadcomSpring Data Restapplication

Pivotal SoftwareSpring Data Restapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

redhat accessNews

Jan 1, 2026

RHSA-2018:2405 - Security Advisory - Red Hat Customer Portal

A Spring Boot flaw whereby malicious PATCH requests containing specially crafted JSON can execute arbitrary Java code on servers.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3