| 제목 | Beetl <= 3.20.2.RELEASE Code Injection |
|---|
| 설명 | (1) Summary & Status
- Vulnerability Type: CWE-917 (Expression Language Injection) leading to RCE
- CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Score: 9.8)
- Vendor Status: Confirmed and Fixed (Issue: https://gitee.com/xiandafu/beetl/issues/IIYAWC)
- Patch: https://gitee.com/xiandafu/beetl/compare/1347394b6bb44f37a224f9a96c6252e90bd86291...07b5632b5135374421e610ba015e8439d4780214
- Affected Versions: <= 3.20.2.RELEASE
(2) Vulnerability Detail
- Prerequisites: This vulnerability is exploitable when the developer explicitly registers SpELFunction in the Beetl configuration to enable Spring Expression support. While not enabled by default, it is a standard integration feature for Spring-based applications using Beetl.
- Technical Analysis (Root Cause): The SpELFunction.call method in the beetl-spring-classic component instantiates a StandardEvaluationContext, which by default permits access to Java static classes (e.g., java.lang.Runtime) and arbitrary object instantiation. An attacker can leverage these capabilities to execute arbitrary system commands via a crafted SpEL expression payload.
(3) Proof of Concept (PoC)
POST /render HTTP/1.1
Content-Type: application/x-www-form-urlencoded
payload=${spel('T(java.lang.Runtime).getRuntime().exec("calc")')} |
|---|
| 원천 | ⚠️ https://gitee.com/xiandafu/beetl/issues/IIYAWC |
|---|
| 사용자 | pigpig (UID 97550) |
|---|
| 제출 | 2026. 04. 23. AM 11:20 (6 개월 ago) |
|---|
| 모더레이션 | 2026. 05. 16. PM 07:45 (23 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 364386 [xiandafu beetl 까지 3.20.2 SpELFunction SpELFunction.java 원격 코드 실행] |
|---|
| 포인트들 | 20 |
|---|