PT-2023-26346 · Unknown+1 · Spring-Boot-Admin+1

P1N93R · Published 2023-07-14 · Updated 2023-07-27 · CVE-2023-38286

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thymeleaf versions 3.1.1.RELEASE and earlier spring-boot-admin versions 3.1.1 and earlier

Description The issue allows for a sandbox bypass via crafted HTML, which may be relevant for Server Side Template Injection (SSTI) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.

Recommendations For Thymeleaf versions 3.1.1.RELEASE and earlier, update to version 3.1.2.RELEASE or later, which has added countermeasures for this sort of bypass. For spring-boot-admin versions 3.1.1 and earlier, update to version 3.1.2 or later, which contains mitigations for the issue. As a temporary workaround, consider disabling the MailNotifier feature in spring-boot-admin until a patch is available. Restrict access to environment variables via the UI to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-38286

GHSA-7GJ7-224W-VPR3

Affected Products

Thymeleaf

Spring-Boot-Admin

References · 12

• 🔥 https://github.com/p1n93r/SpringBootAdmin-thymeleaf-SSTI · Exploit
• https://osv.dev/vulnerability/GHSA-7gj7-224w-vpr3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38286 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38286 · Vendor Advisory
• https://github.com/codecentric/spring-boot-admin/commit/f1f6ac6f613e1c0afc121c8989f28b4155a6797a · Note
• https://github.com/codecentric/spring-boot-admin/pull/2615 · Note
• https://github.com/codecentric/spring-boot-admin/issues/2613 · Note
• https://github.com/codecentric/spring-boot-admin · Note
• https://github.com/codecentric/spring-boot-admin/blob/master/spring-boot-admin-server/pom.xml · Note
• https://github.com/codecentric/spring-boot-admin/commit/f1f6ac6f613e1c0afc121c8989f28b4155a6797a#diff-1ea8b144c29588e08221597d56d8be10b4b4a210f248a83f2e837152a3d2e0d7 · Note
• https://github.com/thymeleaf/thymeleaf/issues/966 · Note
• https://t.me/cvenotify/55311 · Telegram Post