CVE-2021-22053 in Spring
Summary
by MITRE • 11/19/2021
Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/22/2021
The vulnerability identified as CVE-2021-22053 represents a critical server-side template injection flaw affecting applications that utilize both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf components. This vulnerability stems from improper input validation and sanitization within the view template resolution process, creating a pathway for remote code execution through maliciously crafted URI paths. The flaw specifically manifests when applications process requests directed to the hystrix/monitor endpoint where additional path elements are interpreted as Spring Expression Language expressions rather than simple path segments.
The technical implementation of this vulnerability exploits the Spring Framework's handling of URI path variables and template resolution mechanisms. When a request is made to /hystrix/monitor;[user-provided data], the semicolon character acts as a delimiter that allows the framework to treat subsequent path elements as SpringEL expressions. This occurs because the framework's path matching and variable binding logic does not properly sanitize or validate the content following the semicolon delimiter, enabling attackers to inject malicious expressions that get evaluated during template rendering. The vulnerability is particularly dangerous because it operates at the template resolution layer, meaning that even seemingly innocuous path segments can contain executable code that gets processed by the underlying expression engine.
The operational impact of this vulnerability extends beyond simple code execution to encompass full system compromise capabilities. Attackers can leverage this flaw to execute arbitrary commands on the affected server, potentially leading to data exfiltration, lateral movement within network environments, or complete system takeover. The vulnerability affects applications running Spring Boot versions that include the vulnerable components, with the attack surface expanding to any system that exposes the Hystrix dashboard endpoint and utilizes Thymeleaf for template rendering. This creates significant risk for enterprise environments where microservices architectures commonly employ Hystrix for circuit breaking and monitoring, making the vulnerability particularly prevalent in cloud-native and containerized deployments.
Mitigation strategies for CVE-2021-22053 should focus on immediate patching of affected Spring Boot and related component versions, alongside implementation of network-level restrictions to block access to the vulnerable hystrix/monitor endpoint. Organizations should also consider disabling the Hystrix dashboard in production environments where it is not actively required, as this removes the attack surface entirely. The vulnerability aligns with CWE-94, which addresses "Improper Control of Generation of Code," and can be mapped to ATT&CK technique T1059.007 for "Command and Scripting Interpreter: PowerShell," as attackers may leverage this vulnerability to execute PowerShell commands or other system-level operations. Additional defensive measures include implementing web application firewalls to detect and block semicolon-based path manipulations, enforcing strict input validation on URI path elements, and conducting comprehensive security testing to identify similar template injection vulnerabilities within application frameworks.