Vulnerability · Published Dec 24, 2020 · Assigned by GitHub_M

CVE-2020-26282Template Injection in BrowserUp Proxy

Critical 10.0

In plain English

A critical-severity injection in browserup-proxy from browserup. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.8% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)4.8%top 8.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.browserup:browserup-proxy	2.1.2	GHSA-wmfg-55f9-j8hq

Affected products (as reported)

Vendor	Product	Versions
browserup	browserup-proxy	< 2.1.2

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/browserup/browserup-proxy/security/advisories/GHSA-wmfg-55f9-j8hq x_refsource_CONFIRM
https://securitylab.github.com/research/bean-validation-RCE x_refsource_MISC
https://github.com/browserup/browserup-proxy/releases/tag/v2.1.2 x_refsource_MISC
https://github.com/browserup/browserup-proxy/commit/4b38e7a3e20917e5c3329d0d4e9590bed9d578ab x_refsource_MISC