Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.
References
| Link | Resource |
|---|---|
| https://github.com/p1n93r/SpringBootAdmin-thymeleaf-SSTI | Exploit |
| https://github.com/p1n93r/SpringBootAdmin-thymeleaf-SSTI | Exploit |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/p1n93r/SpringBootAdmin-thymeleaf-SSTI - Exploit |
27 Jul 2023, 12:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/p1n93r/SpringBootAdmin-thymeleaf-SSTI - Exploit | |
| CWE | CWE-77 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Thymeleaf
Thymeleaf thymeleaf Codecentric spring Boot Admin Codecentric |
|
| CPE | cpe:2.3:a:thymeleaf:thymeleaf:*:*:*:*:*:*:*:* cpe:2.3:a:codecentric:spring_boot_admin:*:*:*:*:*:*:*:* |
14 Jul 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-14 05:15
Updated : 2024-11-21 08:13
NVD link : CVE-2023-38286
Mitre link : CVE-2023-38286
CVE.ORG link : CVE-2023-38286
JSON object : View
Products Affected
codecentric
- spring_boot_admin
thymeleaf
- thymeleaf
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')