PT-2020-16402 · Browserup · Browserup Proxy

Published 2020-12-24 · Updated 2020-12-31 · CVE-2020-26282

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions BrowserUp Proxy versions prior to 2.1.2

Description A Server-Side Template Injection was identified in BrowserUp Proxy, enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE). This issue allows attackers to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. The vulnerability is especially concerning when BrowserUp Proxy is embedded in Selenium tests.

Recommendations For versions prior to 2.1.2, upgrade to version 2.1.2 or higher to resolve the issue. As a temporary workaround, consider restricting access to the proxy server to minimize the risk of exploitation. Avoid using the vulnerable Java EL expressions in the affected proxy server until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-26282

GHSA-WMFG-55F9-J8HQ

Affected Products

Browserup Proxy

References · 10

• 🔥 https://securitylab.github.com/research/bean-validation-RCE · Exploit
• https://github.com/browserup/browserup-proxy/commit/4b38e7a3e20917e5c3329d0d4e9590bed9d578ab · Patch
• https://osv.dev/vulnerability/GHSA-wmfg-55f9-j8hq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26282 · Security Note
• https://github.com/browserup/browserup-proxy/security/advisories/GHSA-wmfg-55f9-j8hq · Note
• https://github.com/browserup/browserup-proxy/releases/tag/v2.1.2 · Note
• https://t.me/cvenotify/7731 · Telegram Post
• https://t.me/cvenotify/8036 · Telegram Post
• https://t.me/cibsecurity/21295 · Telegram Post