Vulnerability · Published Nov 19, 2021 · Assigned by vmware

CVE-2021-22053

High 8.8

In plain English

A high-severity code injection in Spring Cloud Netflix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 13.2% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)13.2%top 3.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Nuclei, Public PoC

Official description

Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard	2.2.10.RELEASE	GHSA-gx3f-hq7p-8fxv

Affected products (as reported)

Vendor	Product	Versions
n/a	Spring Cloud Netflix	Spring Cloud Netflix versions 2.2.x prior to 2.2.10.Release + and old unsupported versions

Weakness: CWE-94

References

https://tanzu.vmware.com/security/cve-2021-22053 x_refsource_MISC