GHSA-w3x5-427h-wfq6HighCVSS 8.0

Spring Boot Admins integrated notifier support allows arbitrary code execution

Published
December 9, 2022
Last Modified
February 2, 2023

🔗 CVE IDs covered (1)

CVE-2022-46166 →

📋 Description

Impact

All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are possibly affected.

Patches

In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing SimpleExecutionContext of SpEL. This prevents the arbitrary code execution (i.e. SpEL injection).

Workarounds

  • Disable any notifier
  • Disable write access (POST request) on /env actuator endpoint

🎯 Affected products3

  • maven/de.codecentric:spring-boot-admin:< 2.6.10
  • maven/de.codecentric:spring-boot-admin:>= 2.7.0, < 2.7.8
  • maven/de.codecentric:spring-boot-admin:>= 3.0.0-M1, < 3.0.0-M6

🔗 References (2)