GitHub Advisoryadvisory · Maven

GHSA-w3x5-427h-wfq6 Spring Boot Admins integrated notifier support allows arbitrary code execution

HIGH Published 2022-12-09 Modified 2022-12-09 Official page ↗
Aliases
CVE-2022-46166
Ecosystem
Maven
Packages
de.codecentric:spring-boot-admin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-12-09

Affected packages

• Maven de.codecentric:spring-boot-admin: < 2.6.10 → fixed in 2.6.10 • Maven de.codecentric:spring-boot-admin: >= 2.7.0, < 2.7.8 → fixed in 2.7.8 • Maven de.codecentric:spring-boot-admin: >= 3.0.0-M1, < 3.0.0-M6 → fixed in 3.0.0-M6

Description

Impact All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are possibly affected. Patches In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing `SimpleExecutionContext` of SpEL. This prevents the arbitrary code execution (i.e. SpEL injection). Workarounds • Disable any notifier • Disable write access (POST request) on `/env` actuator endpoint

Related

Alias · CVE (1)

  • CVE-2022-46166 Spring boot admins is an open source administrative user interface for management of spring boot applications. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References