GHSA-w3x5-427h-wfq6
Spring Boot Admins integrated notifier support allows arbitrary code execution
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | de.codecentric:spring-boot-admin | < 2.6.10 | 2.6.10 |
| Maven | de.codecentric:spring-boot-admin | >= 2.7.0, < 2.7.8 | 2.7.8 |
| Maven | de.codecentric:spring-boot-admin | >= 3.0.0-M1, < 3.0.0-M6 | 3.0.0-M6 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are possibly affected.
### Patches
In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing `SimpleExecutionContext` of SpEL. This prevents the arbitrary code execution (i.e. SpEL injection).
### Workarounds
* Disable any notifier
* Disable write access (POST request) on `/env` actuator endpoint
References
External links from the advisory. They lead to third-party sites.