Jasypt Spring Boot EUVD-2026-31584

Exploitation requires the attacker to first obtain encrypted configuration files (application.properties, application.yml, or equivalent) from the target Spring Boot application - this is the critical prerequisite, NOT the vulnerability itself. File access can occur through misconfigured container registries, exposed Git repositories, directory traversal vulnerabilities, backup system compromise, or insider access. The target application must be using jasypt-spring-boot versions ≤3.0.5 or ≤4.0.4 with the SimpleGCMConfig class for property encryption. The AC:H (high attack complexity) designation reflects that offline password cracking requires computational resources and time proportional to password strength, though the predictable salt significantly reduces computational cost compared to properly salted hashes. Exploitation is LIMITED by: (1) requirement for prior access to encrypted configuration artifacts, (2) need for sufficient computational resources to conduct offline attacks, (3) effectiveness depends on the entropy of the master password used to encrypt properties - strong passphrases remain resistant despite weak salt generation. The vulnerability does NOT enable direct remote code execution or authentication bypass; it only facilitates offline cryptanalysis of already-obtained encrypted data.

Real-world risk is MODERATE despite the low CVSS base score of 3.7. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-accessible exploitation with high complexity but no authentication required. The AC:H (high attack complexity) reflects that attackers need prior access to encrypted configuration files and sufficient computational resources for offline cracking. However, this prerequisite is increasingly common: configuration files are often exposed through misconfigured Git repositories, container registries, CI/CD artifacts, or insider access. The E:P (Proof-of-concept Exploit) confirms public exploit code exists, lowering the barrier for opportunistic attackers. The impact scope (C:L/I:N/A:N) limits damage to confidentiality only, but exposed credentials could enable lateral movement or privilege escalation in multi-tier applications. The RL:X (remediation level not defined) indicates vendor non-responsiveness, forcing organizations to implement compensating controls or migrate to alternative encryption libraries. SSVC assessment: Exploitation is PROOF-OF-CONCEPT available, technical impact is PARTIAL (credential exposure), and automatable potential is LOW due to requiring context-specific configuration file access. Priority depends heavily on deployment context - high for applications storing database credentials or API keys in encrypted properties, lower for applications using external secret management (Vault, AWS Secrets Manager). Key uncertainty: The description states AC:H but does not specify whether default configurations are vulnerable or only non-standard implementations, requiring code review to confirm exploitability in specific deployments.

An attacker identifies a target Spring Boot application using jasypt-spring-boot through dependency scanning of exposed container images or Maven/Gradle build files. The attacker gains access to the application's encrypted configuration file (application.properties or YAML) via a separate vulnerability such as directory traversal, misconfigured cloud storage bucket, exposed Git repository, or insider access. Using the publicly available exploit code from https://github.com/dntyfate/cve/issues/3, the attacker leverages knowledge of the predictable salt generation pattern in SimpleGCMConfig to significantly reduce the keyspace for offline brute-force attacks against encrypted properties like ENC(encrypted_database_password). Once plaintext credentials are recovered, the attacker uses them to access backend databases, third-party APIs, or other protected resources, enabling data exfiltration or lateral movement within the infrastructure.