CyberRota Analysis
AI-GeneratedDocker applications utilizing Spring Boot DevTools are vulnerable due to the generation of a shared secret using a non-cryptographic pseudo-random number generator, compromising the security of remote-restart uploads. This vulnerability could allow attackers to exploit the weak secret for unauthorized access, potentially leading to unauthorized code execution or data breaches. Organizations using affected versions of Spring Tools for Eclipse should prioritize remediation to safeguard their applications.
Original NVD Description
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier