CVE-2023-38286 Security Details

CVE ID

CVE-2023-38286

CWE

CWE-77

CVE Description

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.

Published

Jul 14, 2023

CVSS Score & Severity

7.5High

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.147%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

de/codecentric/boot/admin/server/config/AdminServerNotifierAutoConfiguration$MailNotifierConfiguration.mailNotifierTemplateEngine()Lorg/thymeleaf/TemplateEngine;

JVM

org/thymeleaf/standard/expression/OGNLVariableExpressionEvaluator.executeExpression(Lorg/thymeleaf/IEngineConfiguration;Ljava/lang/Object;Ljava/util/Map;Ljava/lang/Object;)Ljava/lang/Object;

JVMVulnerable params: 1

org/thymeleaf/standard/expression/OgnlExpressionEvaluator.evaluate(Lorg/thymeleaf/Arguments;Ljava/lang/String;Ljava/lang/Object;)Ljava/lang/Object;

JVMVulnerable params: 1

org/thymeleaf/standard/expression/OgnlVariableExpressionEvaluator.evaluate(Lorg/thymeleaf/Configuration;Lorg/thymeleaf/context/IProcessingContext;Ljava/lang/String;Lorg/thymeleaf/standard/expression/StandardExpressionExecutionContext;Z)Ljava/lang/Object;

JVMVulnerable params: 1

org/thymeleaf/util/ExpressionUtils.isPackageBlockedForTypeReference(Ljava/lang/String;)Z

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · p1n93r/SpringBootAdmin-thymeleaf-SSTIATTACK

GitHub · Issue #966PROJECT