Spring Security Advisories

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability

HIGH | NOVEMBER 17, 2021 | CVE-2021-22053

Description

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;[user-provided data], the path elements following hystrix/monitor are being evaluated as SpringEL expressions, which can lead to code execution.

Affected Spring Products and Versions

  • Spring Cloud Netflix
    • 2.2.0.RELEASE to 2.2.9.RELEASE
    • Older, unsupported versions are also affected

Mitigation

Users of affected versions should apply the following mitigation: Users should upgrade to 2.2.10.RELEASE+. No other steps are necessary. Releases that have fixed this issue include:

  • Spring Cloud Netflix
    • 2.2.10.RELEASE+

Credit

This vulnerability was identified and responsibly reported by threedr3am of SecCoder Security Lab ([email protected]).

History

  • 2021-11-17: Initial vulnerability report published.

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring Runtime offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all