A critical timing side-channel vulnerability in Spring Boot DevTools exposes remote secrets and could allow an unauthenticated attacker on the local network to achieve remote code execution.

This vulnerability is an observable timing discrepancy (CWE-208) in the DevTools remote secret comparison function. An unauthenticated attacker positioned on the same network can leverage this timing variance to determine the secret, which may facilitate unauthorized class uploads and subsequent remote code execution.

The potential for remote code execution presents a severe risk to organizational infrastructure, as it allows full control over the affected application environment. While the CVSS score of 7.5 reflects the requirement for network proximity (AV:A) and high attack complexity, the impact to confidentiality, integrity, and availability is total. Compromise of these secrets can lead to lateral movement within the network and the exfiltration of sensitive internal data.

Immediate Action: Update Spring Boot to the patched versions: 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33 depending on your current release branch.

Proactive Monitoring: Monitor network traffic for unusual patterns or latency spikes directed at the DevTools endpoint, which may indicate an attacker measuring response times for secret discovery.

Compensating Controls: Disable the Spring Boot DevTools in production environments, as they are intended for development use only and should not be exposed on production instances.

Public Exploit Available: Unknown

Given the potential for remote code execution, organizations using Spring Boot must prioritize upgrading to the specified fixed versions immediately. Ensure that development tools like DevTools are strictly prohibited in production configurations to eliminate the attack surface entirely.