Spring Tools For Eclipse
Monthly
Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Script injection in Spring Tools for Eclipse's New Spring Starter Project wizard allows arbitrary JavaScript execution inside the IDE's embedded SWT browser when a developer hovers over dependency checkboxes rendered from a compromised or attacker-controlled Initializr endpoint. Affected are all versions through 5.2.0, per the vendor (VMware/Spring) advisory. Despite the 'RCE' tag in associated intelligence, the vendor explicitly bounds the impact to in-IDE UI spoofing and outbound network beaconing - not host-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cleartext credential storage in Spring Tools for Eclipse 5.2.0 and earlier exposes the Spring Boot DevTools remote secret (`spring.devtools.remote.secret`) in Eclipse `.launch` XML configuration files, which Eclipse persists to either workspace metadata or - critically - directly into the project tree when marked as a shared configuration. The exposed secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes, converting a credential-disclosure flaw into a remote code execution primitive against the associated Spring Boot application. No public exploit has been identified at time of analysis, but the attack technique is mechanically straightforward once the secret is retrieved from a committed VCS file or accessible workspace backup.
Predictable shared-secret generation in Spring Tools for Eclipse (5.2.0 and earlier) weakens the authentication protecting Spring Boot DevTools remote-restart uploads to remotely deployed targets such as Docker containers or Cloud Foundry apps. Because the secret is derived from a non-cryptographic PRNG rather than a secure random source, an attacker able to reach the deployed application's DevTools remote endpoint may predict the secret, authenticate restart uploads, and push arbitrary code, yielding remote code execution (CVSS 8.3, scope-changed). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Network exposure of Docker container control ports in Spring Tools for Eclipse (versions 5.2.0 and earlier) occurs because the Boot Dashboard Docker integration binds these ports to 0.0.0.0 (all interfaces) instead of loopback. Any attacker on the same network segment as a developer running the integration can reach the container control interface without authentication, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the flaw is trivially triggered once a developer starts the affected feature.
Remote code execution in the Spring Tools IDE extensions (Spring Tools for Eclipse ≤5.2.0 and for VSCode/Cursor/Theia ≤2.2.0) occurs when a developer launches a Spring Boot application with the 'live information' mode enabled, which exposes an unprotected JMX endpoint that an adjacent-network attacker can abuse to execute arbitrary code on the developer's host. The flaw carries a CVSS 8.0 (High) rating and requires the developer to actively start the app in live mode (UI:R). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Script injection in Spring Tools for Eclipse's New Spring Starter Project wizard allows arbitrary JavaScript execution inside the IDE's embedded SWT browser when a developer hovers over dependency checkboxes rendered from a compromised or attacker-controlled Initializr endpoint. Affected are all versions through 5.2.0, per the vendor (VMware/Spring) advisory. Despite the 'RCE' tag in associated intelligence, the vendor explicitly bounds the impact to in-IDE UI spoofing and outbound network beaconing - not host-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cleartext credential storage in Spring Tools for Eclipse 5.2.0 and earlier exposes the Spring Boot DevTools remote secret (`spring.devtools.remote.secret`) in Eclipse `.launch` XML configuration files, which Eclipse persists to either workspace metadata or - critically - directly into the project tree when marked as a shared configuration. The exposed secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes, converting a credential-disclosure flaw into a remote code execution primitive against the associated Spring Boot application. No public exploit has been identified at time of analysis, but the attack technique is mechanically straightforward once the secret is retrieved from a committed VCS file or accessible workspace backup.
Predictable shared-secret generation in Spring Tools for Eclipse (5.2.0 and earlier) weakens the authentication protecting Spring Boot DevTools remote-restart uploads to remotely deployed targets such as Docker containers or Cloud Foundry apps. Because the secret is derived from a non-cryptographic PRNG rather than a secure random source, an attacker able to reach the deployed application's DevTools remote endpoint may predict the secret, authenticate restart uploads, and push arbitrary code, yielding remote code execution (CVSS 8.3, scope-changed). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Network exposure of Docker container control ports in Spring Tools for Eclipse (versions 5.2.0 and earlier) occurs because the Boot Dashboard Docker integration binds these ports to 0.0.0.0 (all interfaces) instead of loopback. Any attacker on the same network segment as a developer running the integration can reach the container control interface without authentication, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the flaw is trivially triggered once a developer starts the affected feature.
Remote code execution in the Spring Tools IDE extensions (Spring Tools for Eclipse ≤5.2.0 and for VSCode/Cursor/Theia ≤2.2.0) occurs when a developer launches a Spring Boot application with the 'live information' mode enabled, which exposes an unprotected JMX endpoint that an adjacent-network attacker can abuse to execute arbitrary code on the developer's host. The flaw carries a CVSS 8.0 (High) rating and requires the developer to actively start the app in live mode (UI:R). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.