Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CVE-2021-43466 Remote code execution vulnerability report

See original GitHub issue

Hi there.

Recent version of Spring Boot Admin is using org.thymeleaf:thymeleaf-spring5:jar:3.0.12.RELEASE and this library is reported as critically vulnerable that (under some not publicly announced yet circumstances) allows the remote code execution.

Dependency subtree:

$  mvn dependency:tree -Dincludes=org.thymeleaf:thymeleaf-spring5

...
...

[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ cloud-microservice-admin ---
[INFO] com.example.admin:cloud-microservice-admin:jar:1.0.0
[INFO] \- de.codecentric:spring-boot-admin-starter-server:jar:2.5.4:compile
[INFO]    \- de.codecentric:spring-boot-admin-server:jar:2.5.4:compile
[INFO]       \- org.springframework.boot:spring-boot-starter-thymeleaf:jar:2.5.6:compile
[INFO]          \- org.thymeleaf:thymeleaf-spring5:jar:3.0.12.RELEASE:compile

...

Vulnerability description of org.thymeleaf:thymeleaf-spring5:jar:3.0.12.RELEASE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43466 .

Assuming the issue description https://github.com/thymeleaf/thymeleaf-spring/issues/263#issuecomment-977199524 can you either confirm or decline that Spring Boot Admin is vulnerable to it?

Issue Analytics

State:
Created 2 years ago
Comments:5 (3 by maintainers)

Top GitHub Comments

2reactions

adrian-skybakercommented, Dec 12, 2021

Any automated security scan on a spring-boot-admin build still gets flagged due to this dependency however.

1reaction

SteKoecommented, Dec 18, 2021

We have included a fixed version of thymeleaf in 2.5.5 😃

Top Results From Across the Web

Remote Code Execution in org.thymeleaf:thymeleaf-spring5

Report a new vulnerability Found a mistake? Introduced: 10 Nov 2021. CVE-2021-43466 ...

CVE-2021-43466 Detail - NVD

Vulnerabilities. CVE-2021-43466 Detail ... combined with specific scenarios in template injection may lead to remote code execution.

Vulnerability Details : CVE-2021-43466

12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution. Publish Date : 2021-11-09 Last ...

CVE-2021-43466

CVE-2021-43466 is a disclosure identifier tied to a security ... specific scenarios in template injection may lead to remote code execution.

CVE - Search Results - MITRE

CVE-2022-45550, AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE). ... This vulnerability was reported via our Bug Bounty Program by TheGrandPew.