# CVE-2017-8046: Pivotal Spring Data REST and Spring Boot - RCE

> Live exploitation tracking for CVE-2017-8046 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2017-8046

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Pivotal Spring Data REST and Spring Boot
- **Weaknesses:** CWE-20 (Improper Input Validation)
- **Tags:** java

## Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

## CrowdSec analysis

[CVE-2017-8046](https://euvd.enisa.europa.eu/vulnerability/CVE-2017-8046) is a critical vulnerability in Pivotal Spring Data REST and Spring Boot that allows remote attackers to execute arbitrary Java code by sending maliciously crafted PATCH requests with JSON payloads. This flaw can be exploited without authentication, potentially leading to full system compromise, data theft, or service disruption.

CrowdSec has been tracking this vulnerability and its exploits since 10th of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2017-8046 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending malicious PATCH requests with crafted JSON payloads to Spring Data REST endpoints, often targeting URLs discovered via HAL links in API responses. The exploit leverages the `application/json-patch+json` content type and attempts to execute arbitrary Java code on the server.

## Timeline

- 2018-01-04: CVE Published. CVE-2017-8046 is published to NVD.
- 2025-09-10: Rule Released. CrowdSec releases a rule to detect CVE-2017-8046 exploitation attempts against the CrowdSec Network.
- 2025-09-11: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2017-8046 for the first time.

## References

- https://access.redhat.com/errata/RHSA-2018:2405
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8046.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2017-8046) follows observed exploitation activity for CVE-2017-8046. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.