GitStock

codecentric/spring-boot-admin · Security

Spring Boot Admins integrated notifier support allows arbitrary code execution

GHSA ID
GHSA-w3x5-427h-wfq6
CVE ID
CVE-2022-46166
Severity
high
Published
Updated
CVSS
8 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v3
8 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Description

Impact

All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are possibly affected.

Patches

In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing SimpleExecutionContext of SpEL. This prevents the arbitrary code execution (i.e. SpEL injection).

Workarounds

  • Disable any notifier
  • Disable write access (POST request) on /env actuator endpoint

CWEs

  • CWE-94 · Improper Control of Generation of Code ('Code Injection')

References

Open GitHub