Security Research
CVE-2023-38286 Spring Boot Admin SSTI: Thymeleaf Expression Injection to RCE
Thinking
2023-08-22
3 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
Spring Boot Admin’s UI view layer uses Thymeleaf — but Thymeleaf prior to 3.1.0’s view name resolution allows attackers to inject SpEL expressions via request headers, and the template engine executes arbitrary Java code when parsing the view path.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd89376b1414fe321ad5bb4a1f7d951032a8a9705988f8f267f7dba0cf016f7d8a26ae8a8d5f9818582451a3199a57048e289c583785d742fc2a7b78ed69a5c6b9d41030d4d6e4f1af37b5cd442f4b64560a22ef4bed427ff9018ee1ac9f27c21f77bf3eb45f422875137a75d01e740fc5295f0868d62d58c3ebc8222eecf1f002058b6986a3cf77ba7898d0cbe5f665ad8487d45147d6f876a5453b49ca7122ef895fd54b40b12d02765c5e670833b3f1c8dee867f993890a34de92b35325469657bd9838f16d7ebc9f57bcbfb205b241d4697f45dfee6b9e4b6eec93b623298f8223fc934ea07cf47bd277f9f45b6ac872b529efb2b6cce4eab0a39dec9ce4535b515dd18df7104aa6fbd305dbfd624b27a6d56bfb78fec6a46840396ef2e12f15ccc1df18dd251fbceed61b484c748fc464c4bdf96d0dffb50995670a05e3dcda29005de9fba9d271076b2072719e9fa3111bfb6ad9a7b2527a46727033b2c2f6e915cb02ab5c3a8b9c1806c4796e86057f28d3a85503bfdbf83557055fe5838bd6a18ca0408333994f281b8333eaaf362739bae690b2ed86423f27a82756d4ccfe67955f96a2139c4c9bb4d7438ad054757213c194eadc91085665935ab737cbbd52da9203da03bb1cd9d2f642cb382b7ebdb8a3ea35a4b4bf294b65ba391bca08476ca2441e14699d9c4cb36d38642808082c6e3b55ee9dcb2d8cd2562eb7623eaf5884e3ada2128c83798a7bd81ebbdcbdfb4faa9fedea5cca9f15615a77856b740217c678314b8ebb5b8e943cec331abf6ae1ffdb34762e5c39816a7a311c37a0bf8c881636e5f89ebe35486b5a14dee0244a54f34e31dc856e6f0aa22fe3adf2814a9e7598c9fbabae4fa079bf5227ea7341cf77841f8a9ab3935342395a2ce40eeb96942287819a16fbcc4b6b196ddd5053223fa68ad9584c3b520e8b14056d0c322208a9b9d9bf5b294d118d3a50d092d61586d43135d8df90168db8e06e5dfc5e1fb3637f77fe2613c73ba1caa7e2f1e35c09c8f6db6d6da2db615380c3db487b69930b4f36caabe7e4796939e86b8864debef3f962c3a03f6519b5034505d3ee4e0ef39ddf4c2839b08028223c70e7f11a85d269b41b486a250edf5c96b47649caebc5850408d5aa0a32383644e2809666249ae79f0d214b46a9da5a4b7b1038382f75505403674e15893f95c03c2897bf961fa45af4096ad6433b9543dab69eebfd145b7dc0abf61482926d570ddc300562fd56986e233653413f30d7f9575fc67ae86173340c0599f5fd025a0a900f845506c32df173c0dbd0faf57c715d843896a0897e2a1336aeb5dd14694e92637fe6449202cb6e45ab13705920bc931824f99933f7dc83a58be3d448b76e19b613959fe8625de6b4162e0b601a67de89da2531c5564df7f12b48a9fdfc01f53eed283ce3f41b269d6b373394235433b4463891d475559033780a6344ab992250b86c9a0d69b9c03d52a2b810fc60e59cb6bc298e94be3c070d3229c4d536bdb9d6770b6b7b0b52d85e99cc1b55d8612757b3a6a234ce9cbb2490b720e7eb4fb96caee05b905792476ad3c3b019c9b5b65412de8276baf9bdfd8645b5577edcde17fb6cf0dad7961c40ad4956adbe7d56c605ad3b9fde47f04da515a06f13078e8e4121116c03283baa2b3ba10ee120f466dbed3e7c75c09ddde15d730f2177ff164f64a2db3fdea6585cabc7e1e5a1c38088c9d4049ed8f3341ae6f66b90ef20123bc83d95d11b08ad1287547fe806fba12fc83317474f9bb4d853b5675b56096a1670c3b2103164ac4b36543864eff9e9186f682d3f8a34d93141f45ef1e34a154d05b33d86d5df138f8a3476dcc89685240aaa6c8a90d2d1e8b25a09992f93ca624aeed3f92cf55d5734a5523c17d710ab3d93016075833234a79ed6ef43d5c9481e14e3ee9facad96739c76c5005799970474954072f93eeba3d13f330c2baa197248452d72c5f8d86c511b3e50245a698dc91f4a3b179396d9649b337a5132841b31e3fa4f2ebf2c6326458c580e564780ebf9e6291c5fd9054290ae3e3910071d55be395e368306d614f7a541ab3a5209808d0e9b7575f082df9df107ceb9d3e91bec5c66f616233988577a25a75546c49fe3c0136b91a49ee7e7a7c912a73a92de89fbc374de2cedc9fdfa2a87173f76d0462a8d93084e6a7720c702a6261effdf1d36fe8b8da3431d6d44845baddb7f663b22312594bb7139f5f328e2bc71ba7b08773859b754a9b073b5169f33a0a6e269ee3692e1715d3b235f8c91643e91cdbe2c8bdbe75225f3b4cdf4755439ad47a5c398c10beae3f0199567c9c8b6bf20453ab588095459240c94e582b1e823dac7219b7fd0c8984c8771a77e010e882fae8b77224792d4c07cb45d5b7e3c389470b0316246d4175f0b0bf74c847a3d49f390ae68bd4e4e73af03774d66e1bf082f99203f88714427d2a7d1a1d52e479a46cc00e262c5948d1ba95cd5355f3629bb58be8ae26197ff4a6185caa06e0db1ef30cbc99edb4c581cec0389537bde335902356668e2d2e396fb07566671dbec21838a5657f4c9758b4c1ca5aeab424199c895eff2f19774cc7d8685f13bfed338bb02896fb70054bf37d3e2339cd2d38eb8062fa2cb45249de3133d652c94656f786bb3b05b2626e2adc8adcc39588806938106af15f113e24f5624170ee44030e3be1696ff1f44a19a8150f2eddf4cbeee1a0e7733a14d51ec1d9634a3c55b2017cbe4b1a6f40ae7fa8a617957853461fe177c4f33ade97567559d1603e361b69545e950d52ad70fc69a15c27a3acf39012fae18a2e6ee5cd7d05f1c9b2440e8cced20cb5fc307c378b35366c90fca35191790cad23e687d9f6f6d967f029d942c9fe8799ea53501349dae8c7f7912fe15e7a6275392cd071e3f455f13eb9f97a9185e160f8e4f66bf73915a9e502999d9fe953d78f6a5639d16354e50795149401701e0eb8c04b3cb5bc1ca778e3ff458b108a48c3eebbd94957667390c57e45c6c5cd2a3ca0634c9d23e886883c38045e727d36e5e9fa16e1e8087c12f69900ecc6a3108c227457f6c30a6d8972d22818afb344c8502aa5d7f252ca7db2f980cad93f8c7415cc4d907607a2229d3f2854b79cae86146d25b7a584096c8dde07f467359ed7e7517c637728ab2fc390fd3f42f9725be6407311cfb20ad3f55375997b83036846b216033974058d5c896488226ea63a6f0a32734c71f5450e7c81740bbdf8c9520210f12830de2bd3d76d6872bdc057b3983113929284e694d647416e55d1e9da50614f9b586caafd7c5de3702613d7761efe6e35b6201a97cf9f2bb38cf2f6d75c47a511c2d65ecc5f9838b4f831cfde2e748e3c39c61d37d10fb855b0e84dbc46b79bd0099ffec8125f81a52f013c654ce32b42e23c77179c2cff1bd3c752dca7cf3cdd0058b189ecbca2e701630bc5c48ee7eb4497dd1cb2eb544686f29fcda096709c5c7b78a09214850bdde8449a3f390ebb29e37e719b6d598783dd818f2b747cbbfc2cbff56a3f403dbac27549de69b80ef979f2e52972571d64f90c6ac562311e1ae2243f3add190696760b7e7fa866a1b73269d664e136529bb7d9236d5cfcea73120407ff7f278283c378e45786f2602e501dfb3acfff097f038800bfeb4991b782c8faf9096da64a4efb1bcf75acb39c9fd8020deb4321df328cf2300e6f17c9476ad26217f0c6a7ebaa9a80846a30d353d49ccc4385dead6307b89c8993baf298299f0fd218827cd11dea0068bc77f150432777003e516d402bf2e0806f060dab2a68fd6a27c7e8124db253c95f086d514aa4fb5d0a3297797fd1d6101ba04160bad3a5768547d9f3c4b3129508fe99d59c747c0ab6942ba75fe109ceae15cee6a382575b3fd1c2d28bc95ec0186d98d8284a4af596555acf8a451f466dfa1d9ce09eb4e0b549cc11b84a176cbd2fb613481bdc8c65ff4edd1e1c08350dc86d54938ce09aeb7109ee4208e0f944bb0fc20571e3c9de08bfa4f1804d9f9d26577c92462a3021e4fb85483849d85201c433a6e7797db963cc4d5d65516c548371489185a65d006a0fa3a6d472a435263377bbd334e5e20d11ef55659d37b72f2f08cda5953e4a595a32f838048a36b13dd5cf0210c1fd4767dba71ab006d07d557b8f219f9c434d826264639647875113f74f8acde5fdddfefd5c1f15bca898f0dc18795591e7fc99eb02d13c9c660f37cb32d9380461a83548fb13ff4d1016578a3fe58c850689efa598f0ee3ccd4840aa13070a1fec6e352288cad11fb06f7196f2faf67f225c5dcc2845978f7cdcd492cd8b0bcbd6160d299ea4087d3f1c19902c1f12255f34c1f96c3064113fa56402e8c02beb7acbfd6f3b15b719d5751ff5eb0c69c8440122b16526cb33d32a2ed71e3dd60c20ef830b2b0b692ff21e99ec78ce785e4ef45efc4c3b2fe21e97e169db5ffb6bccbc42ffb41ca8646a3b531712c36eca2f2002cd11f46e8dbd9f3cc05e14af5e7cc20ce13173ca92201cb90f699580c1210a16d0db65489f19a667ca196ccbf71acb8ae4d6dc5b44c18cd31538609b0da2fd78bd639ab932e233c2a9543766158be93cd0fc9fa09d5fdc15c64ebdd1862b32285b3e90fa5b429e9dc72aabec42afc9bd6c80c0792280f315b4a48e0c8c259e2eba5829ffdc0912865b2de02a658664ee9ce17c0cc39ddaa1ca403518d083c541c7b0330223e2af7e2802260e0226bd11a432c0e2287f4dd7fc4ea47ab0a4770ceeb07af884cbc37c9465d3309b88ab093ae4e4ceb5bd8ad26b84f62f3fa90937069a0969f338ec25b31415a697af0d4a0a67470152e34b4ca65064acfe2fb8fb6279f7a14dbb2d65d5153782aeddc6b9241365b48d069ca7943fc01dc5de8407ee239efaaee97a0345dff9449bc45598a9b25e90a478adbac71b21736438c7b96c0852cc68c744ceeebea00dc18d43e2efcfe797e0624d319cb777c096edbf24c7edcebbf987d27d31a8bba189d05a18339ba0ce403f3b28e2907ba181b9bf354ae68e7b997e4d0105dcbb922a7fa0552c32dfcbb8b6159bf987d7a23dadc16e2996a174259660b6038716a4cabd89c9afc60eef34303ae5052756fcad78813dfe87db6d77421e4ba34a9d9aa0b50dec6502f0afad9c497fbb794bc55a9e3d732071dbb6f98af98da2a3cd121dfc3778659079c1bf36fa955716ad67eb736f4d1f2dda67c8fd3acdcb97625efb96787fac5b4ecbd8ba1c6defb4091e6429a48679df71705720054c43a286ebddc7052375d3f2d2c5b9f352ee8f4661a17036291c9c8d914d87b0665ff900e04c45dcda0d97cec6d1209a6bb4030a2e2e97f6a4f90ad0c14a09b6a063893fe172d54f1d890476a7e4346595e5a3a09e6aa9cb289736cca415526c04691b19de8b22a574fb93834667a9cb6c9b306c10857862e4cb4d11a693d37f49cdb6ff2def8b3cc83c171f3316ded7e2669c12cc6861f9cb752d6093dac0187aaf490e26f1271eb96eb950c5e79f3d65a7b00c49f1195055e3f83ab8c548a3fc7a6655a57b0286a4fc4d75e67f723c5c462707d2f4ab43fed9e5d2c0f15958738cc817cbf9317c86f7c060d8af22c48c3c1cc016dfdbbf53479202485c62e8b35953bb85ea773c5f15504507b00265e518e73c766c9b61d2bcac4e4e2c574d015f32a222f4e309bf72afd6ebf5a6d99085f6c7f0457a027b991ec80f4fab2c72693f4225c7adc0e4fee48337f17ea63f7dfdbdcc15c71360787920b25249427386e62ee72eb0ec5c96dec5ebcfc66d800d51f7c862331641a6116be43898d0bf9caf0bdd6cb300653b82b6af20ff172ec6e8ec0c41199514144e490cfd95a4f972b6fc881d2036646f98b6aa49e73c1a88e9109d2a47f8b146298a0004fcb336a6943ab59372dc4bdc423ad4df45252d2e5e5c16016f08984da433561564da4d031a69ab36d0ee27bdeca8e51e65bb2cfbdd478f3125d61645196f05692145bad2e9eee799da67ec2d989d39dac92fa65ba0adbf3aae3c416d21e120c13755c658094869053de238bfa472952aeb6a8293435a9c06fa61af6eed5fdc3ed0cd6d643dd2c47b1ef0f7e270848dc3d969e1cff50e250356390ee1e0b7887f3c628ff8ecc9e11a47c56e4ef454dfebd7ddd8e1b2f574ac2c52ca899ca11f6df06513fe8c5ffafdc042c0bc7210d457ef744734d5cc52eb6cec4ef4f1a3f948db3d8a96ec75f8d9e410ddb8a1dbaf3ad9c03a84130e05a7198c164c0b57f12139ba472785ae38c3a320e589f1de97e2e9976964756fe770330944b8324a81a35abbd3bb907b80a8c5c717f1b1affe7a1cb32e393dad29fa117d76fe4c1b743674f58de61a43987da6784bbbd833198d3148d4efc21bec2dcbc6f9ecf9a5dc99c500b8f9930c1b6733dcaaaa1e2cdea19ae89134bd0603a5c0cc3f8a2e1936ddd885c5b30a44107d49bfd5e96891283782e93fdd89dcfa13e1d01e6fd8ed16e516debe5abf1e6e6b26c3733f002d5f7ae8764dd62142e638e4278aed62d4fcfbd2ae364946cab85880e012d1c10ec774fa92f7b236abbbf40cec74553c717abdfa2628ad55e484fbe74250e3184c2d886764ad4e63be2304823c716425d59fb4b4af09ca74ae56da8e94ce1b11914ad66947a2b9eef08284d9af62d929d5b1016364a15e5ed33d448304ade2267986e5a935b62b077f28bbd4987c38527dff3f12f87cb6626a8a3c5e362b6189ab850bf434608cb7d28e6ebc32d4b2e85e8c2543272a9ed89fb71ce74d18d414ee144be69ce18df92008b5a987d9a30343b01d5fb66477f341ba3ad8aae82741a1f0936d32803bb082488e8db5f0d07718f3ae57e0e2a89a2dd55b393cf7b168a6546d10dab7d0c13d7fb0ee3a4c9b5dc2d270932f0e3f0627333a876ad6e925e271dd44d635e4a2118b9ed8ff0b2fa103cfe104bb679fe6ed5a28afc0232bf5c1f16cd70623db32a87e04c19b3