支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 9bc817880c4b4944f47c4b7b8191f6c5f343e060

来源
https://github.com/Vulnmachines/CVE-2021-22053
关联漏洞
标题:VMware Spring Cloud Netflix 代码注入漏洞 (CVE-2021-22053)
Description:Vmware VMware Spring Cloud Netflix是美国威睿（Vmware）公司的一个服务。通过自动配置和绑定到 Spring Environment 和其他 Spring 编程模型习语，为 Spring Boot 应用程序提供 Netflix OSS 集成。 VMware Spring Cloud Netflix 存在安全漏洞，该漏洞源于使用spring cloud netflix hystrix dashboard和spring boot starter thymeleaf的应用程序
Description
 CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability
介绍
# CVE-2021-22053
 CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability
 
 ### Description
Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.

### Affected VMware Products and Versions
Severity is high unless otherwise noted.
- Spring Cloud Netflix
  - 2.2.0.RELEASE to 2.2.9.RELEASE
  - Older, unsupported versions are also affected

### Mitigation
Users of affected versions should apply the following mitigation: Users should upgrade to 2.2.10.RELEASE+. No other steps are necessary. Releases that have fixed this issue include:
- Spring Cloud Netflix
  - 2.2.10.RELEASE+

### Credit
This vulnerability was identified and responsibly reported by threedr3am of SecCoder Security Lab (threedr3am@foxmail.com).

### References
https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L


#### Follow us 
#### [Vulnmachines](https://www.twitter.com/vulnmachines)
#### [YouTube](https://www.youtube.com/c/vulnmachines)
#### [Twitter](https://www.twitter.com/vulnmachines)
#### [Facebook](https://www.facebook.com/vulnmachines)
#### [LinkedIn](https://www.linkedin.com/company/vulnmachines)
文件快照

 [4.0K]  /data/pocs/9bc817880c4b4944f47c4b7b8191f6c5f343e060
├── [ 256]  payload
└── [1.5K]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。