PT-2022-1573 · Apache · Apache Shenyu

Zhang Yonglun · Published 2022-01-25 · Updated 2022-01-28 · CVE-2021-45029

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache ShenYu versions 2.4.0 through 2.4.1

Description The issue is related to incorrect code generation management, which can be exploited to execute arbitrary code using Groovy Code injection or SpEL injection, leading to Remote Code Execution. This can be done by a remote attacker.

Recommendations For Apache ShenYu versions 2.4.0 and 2.4.1, consider disabling Groovy Code injection and SpEL injection functionality until a patch is available. Restrict access to the affected components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2022-00791

CVE-2021-45029

GHSA-GH38-X2WM-XMC8

Affected Products

Apache Shenyu

References · 9

• https://lists.apache.org/thread/3zzmwvg3012tg306x8o893fvdcssx639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45029 · Security Note
• https://osv.dev/vulnerability/GHSA-gh38-x2wm-xmc8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00791 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45029 · Vendor Advisory
• https://github.com/apache/incubator-shenyu · Note
• http://openwall.com/lists/oss-security/2022/01/25/8 · Note
• https://t.me/cibsecurity/36216 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/26/1 · Note