安全研究
CVE-2023-38286 Spring Boot Admin SSTI：Thymeleaf 表达式注入到 RCE
Thinking
2023-08-22
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Spring Boot Admin 的 UI 视图层使用了 Thymeleaf——但 Thymeleaf 3.1.0 之前的视图名解析允许攻击者通过请求头注入 SpEL 表达式，模板引擎在解析视图路径时直接执行任意 Java 代码。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9247686c788226e0cc05eab1acfb818177dd26e03938f241d87bcec7eeb92e8c4583632d67cb2c5d912da560c6a44ba47d6014bd9268a14689e8319ab763025a8ef5962bfeb375fbdc52c7c0ee02f73f3c7b05d5b1f2aeb41af5039af804c10696af84aeada25fc64d6b0cde7eda3fe5fc3f3cd30ecaad9f966d6dc260f4bffda666d0e8ec67e69d2f882fa35a50c06386332893918155c81a35578a3248a979c4cddb7025cce3388811d888a9aaad9afe6b57b664f1b1ee33e4cc39ed85b0e73d1a9a77ed44b5cfe11b5de751a1297bf852ce1da1caef988417dbe7084a005075feebc5303ad044dc262ad61ca33e40b30c4c31ffb66c4666c794f1216bcc999e298a7c2949bd4162c75e2aaf3a0c50ddfba482166f0946bb82bb5c7ed7f0a257efefa7f1ac1d4c94b90661faaf8930e5342798c9624d4b1a2316bb0f64297792019ec98937f1e41adaeb7c132086632723f81cfb4070dff79c8acf7117b5d63387cb2ccf7e75bd7366dca934e33b2c15fc1e20e93206bdae81834bd89bd6612440da6d7c2d1b8d8a6018e218817664bd803e0a3342b3ff2e68bb5b484496377d6621880cee034c50dc3a81dc70e97b7c21d98891b6e79408299ec84d916163bc90f75e83fa74ec691129458a90a8b9df451dd7a773ff8bbf361e45689ef7d4e7fe6396d9c491b39ea1703137ed0b541b86b2b2569015c3f1d783e939a15aa37d54e25b36935ea7c9ab33760e71a71a80cfc37994b2b2d038020035eea5cfdba523d5a748870392a2de0fad7e9c4fd5a90c270836055f33ca4addc3b4137586ed36933105936ec93a9b80528b8f984ad6a3028121990af701356f54b2881d2283876a26cafeca1d2579c3b9589bea9b04dbb27ec1f21ea2d46c26a841c85cad6c7164f751b6ea142f5c0428757046fcba8b8265a4031d0021f4b77abc4960c09361e538d181f6f51152602facdb48e4d660718cc6732dddc9941c3d9727a8acf9c0ed9f9b24c78ca4e0ff1343f3fac6c429720201948f4acf25a09dbbed77620e8b55672c098855a1d0d80d6d390182e4c7193afb91abe409a19340278e41a5cb9b7a2b4221c01d8f15f0efbde53ab91b4675fa1c6fcf1781290350d21ed58577b225c8c0591bb414ed7e39ec986d80862cee8a2e788275076e9f019626ef3ba96b4212fb9c9d18dbecee3301d1e582c0f5603e7721ba9f31e7375843ba46bd1935c8cc0964dc2f7c0e6ee09553df5e5b8138e8d7e1c1a842616ec36b108cec068124a242b889f571c8e33a4256f6b1a038caeb215560f9044825503d13ebf60cbcf9bc9f2716d198732cca0dc7925557bf9b887773f50b8637fe644921e9f7201a1092f1637e8c74a22e69d21f682c9fa80ffc54ce86110f91896c9b3aa823b3ee6c8c0c3b27bd1c1c93b1bc55651bfe22b0be5a0eb1bbe3cfc212ef5e6546787232a3981341a37f84a328993667f922d6d0c790ca6cff7e732aa26a4af0354f4ee2cfc0afa32ef9eb0e238dcd9b874150c3e32c99d4e9af64588a2edaef1c129980252befc3abae28854f6a43cdb9cefa54042b46f14c1459b671cb30f847ac7c5084365ba5d516c1d2fc9dd7dbbf1e9918455ad5f6493f97eef6cdfdedf88554abf044cec20a3ed52cf42be5708dc5e8a32f340e3c5f60e7f9affb78a8bc5b324cffb28e505e327974f11e0fdd82f1b1307d9a8e6b4f751d18a88202b9d86fc5145fd8d84e5e796d2dc818d59dadee77e47ebf13dd1fc3c1f21d861c3ca1115e81a9b4372b706f5b96a96251a5c49dcb68238e12619175a2f16209ea9506668b24e360b2523e9ffb441217e27219950966504f912b0bd001d064d68a5665b149d095defed015b88d8294af107d8d39adca6fd0e4c882996d32142a08c807fe85f0571f6177d59dc4ba6309014762bdd7f28b688ddfa138844e8f79c2d2c57487cd4658026922f53c09c0475dd427bae6d88edd12c3d1d25ba126ec9bed772d2fcc072474a794327093fc28a52133d96407958f175b4b2a4b25ae933aedf4d20a32a2a210a97430344539febf9a1e2e4845feddd1442e3b5fb8bc9c61ef8d286f426fe50315a8f34df9d8d4a5b8e0ac4bf7901092c5b07b6b59ce311a6235cb2492f258912377530b99b4a262f4ad188537972d9fe8ca54620bb4e5e526556bd33a70d133664fc29ed96f73cab75c984414c3c1820db41e9625bfdaf2663a7d6dea34f556d4c8d43a9c73020692e2c6087ac6324bdee33e5f9748b672258731ef12efbf520e65fd07da0e9e33da0348af5704b2f2f11c6866829dda4f621c594b31734b0b1c6e7274a632c970447761944b6b6e155fa348c89e4fc684874e698050f1b2b0f96fdd3b2c0719f9464da2d9380894adb25a13f03129566e99766731ca7ceda79fc5f516b3f351f8b56bca9e20fd88085fe1bd342a0e7f80b450bdc7ad5e1b5178cb4edd46059d1e758e7b65aaa91bb1e271e4b52ef8c17ee078c16880f6d66975dad59c1e9ecc668c56e7a6b985e71ca94402777eeea1c68d62a4b251dcfa5d667e2551a28d37c4a0678627cf18da9d577e3bd313f5701d4d7d75754f58c3d9c5641fcf9b85f408f85dc670606904fe0bac4848c98225bd934884d9337ad9134d62526f94152042362fdef252ef5e84118ca89b8a6608db4d189262ce7a1f1232e566f50ddd942f57100ee0415be5a778cb4b6d6d523a0e72571bc053bedd42d5203bd182e36bdcdd527203ffb4f8c02cd52c001eb47efd99833453152580fc8e0d945724a8e2f2fa99aa5aab97d0ce2aef3d2244bec65b68e00e65798a748e65253d24c98db5aa5a5e97eef370812d93e3590d371a78b204b1cbf4d8b3793319520ac905286af500d892b3e2591d68409fe9d11bddf070bd91750a21054aeaed250272c9ffde70988284aa7bb3a5ef4d1b7c5b19e4b4dd2f214580e1da40d33eb73c512cb0c6da4c7b9c47770fab23bb76a63011efa9fa7c4caf36f034fc1520e71aabe6d923ff85ab00cb096fb037d1912a1e4caecd322aeece709283de2bc3b43ab3cb10c2a768615ce4788b50c7bb2994f0f45f0ae10c063e0c2a54cf7a8141f23e6d9c33c3585a0f12e1ed85dad18752f3df3d529cc10c498fdd538781c4be5ef98a7c674694debdc0c4acacb3b8da3feeb1a062d3beef2b5ea40cfbbf000e48b0d61387706ffc645bd946a9d8ff0c471fd43fa80c00987881d668c256671619c4643d188971c8e32b442a0e2be203edb44585ebe895c40fed799ab3a26045d8a06d4872ab9046fa905fa155bf01c3c254751744dbaf2ff66bbf11b7fea4cf32d3139efe4bf913957fdbcb6ef712c6e82cd8654af70305c7797ec8e98a003450e386eecc2a9e8ec7cbe59a5a3f959e2cfdf73d3750de19f1521f0f8fd3020b351cce8e3d279ae534df441c16ee51c976d00df2364c2cbf4f62d2c02c9209a8eee34c106b8cb8e61285e30be585efd1c8f52768d8b3e8f32262160a8dc147010c9c6b7c3462f5a41b4d18c44e0f2cfa7acb41cb803f1d9b2792e9873d8b05ff79e87c2e247b7b1980f66aea42724120c006c41abaa6eb7966ae1541569f1f241f19d1440b2311957efaafe1a0f21f6a7accf377f9ea28785bbbb5a8301fe8a520acaeb9880601cb17abad478485e522156b137edf2f9cea098f266c845b2337edbbedf7622647dbd0bac9a85a9f161d0309dd6822a82bd5d1ce624c22b72c6c8738d3adf0a6b374b7c13f7a8ac6f25994b3c3e4b89ab5318e986b481534a7eb332d259b38cf4249f73c608c7cf17c489fda1dab993a49e0be757fe6ee8c9e570fc3a0b6d51d6b4747c9a2fcf7b3795f1d21af35c02bfdfef104dbdbb5b24c777f0bac72daf8ebc074b9d59e59753d14753568956922229dda32abf2ade0408cb1db524ada3de5f34cba0af4c0300f80e291b284a6333c79ad47d1e2cf806c75e5ebb9550b83c0a528d880595ee7dd7d6ea2d3dc0251f0cd3181d401912099858043d9db80deac5f05a92ae36911adc837c0ea39af7bb7243070dab8ed537627cb4fd059327b1091303a63bd2c3ce19f5edc1cae604c8c89c26d694e0550b9180e9ff1d8efad715c66802f8e4a6d9d48995bc8a35a5948eb335c28b164bda151da2f3c350c6896e7138c6438ec10cf0aed32ac80bf988931dfdaa5032ef88f1fcc24aa3f557cbbb1a9b6933053c2061741a3f14a6d8bc4f571b179594b01b8ed6d90095dcc7d9e2ce485341abc127cd36ee71bd60848950148901c8f661b4c0e9c8cca9a0d415c4fd6821db13ed621b12c24920e9cadfb687ba5211a2995c7ce13d86c7f722a621a6062d06489cfa4d2d8c5a1be5bffde4252efce8a943412f384105c8b3a16e17bad1e7724fe19913ca4e532e8c6f99b5a3b0a8effe1f5d804d10788e5051205cd7fbcc9aa2e432efd16a26b67a25bdad60fb60e22759657d90231734782f740e8826c2b2d3d6c623f56d78dcecabfaf9cb439726c00359c44b79f4a9fca7340d779ce845e78c2d0310662ded7ab51f6d399e1985ba8d71c8c6346c6057b299d5e72c83b931ac78746692ff4e3f4a5ff9f8aeb34f68caa7045ad23f55d80df4c32fd4ce3b970156c6c2b5ca54c790f2db5c4247bb523fe10fb4f56855d08ed1a252a6717b63d30e32d10eec77acbec523d6496c77ade67aa1b5d49e97a960210690002b284575382476b899374ac847d883b1736bea5518e15d46f02ac79b629ab891fb808cdc8ff6d02c7370f0f60fc4a925e187f2fbb6643a5db16460aa4e83ae9b0b36f73a748aff03f40fd4c79d38786419408bc81a9e507ebd37938e1c7f3b56e29a237f75bf4825cad09ed2cbd13b6935698a9494ddd3380580c3bf067f0f4975af3db5db27250f82d2c280ad2003a15a9ab2b2a913da664267f201118b0acaa82ba5365429142be2d26e8422e13227835dbd619baa565355b5f7252011d63bc0cef0479fcd7e25d5e3ea1fdd1956ccd68fe362630124922ece77671e64b7bd283d88aff0a1dfe1722b97a7129811a1b61c8e7ca4bb015b4ba6bd3e84cadb8054bd75fdbbc56f5de9da4a72a04d2189a20abb71214cc2c9054289ecd1275de25602a5fccdafae064836687f4199cc839afc27ba7bf7f526a4b6ee94145d34e25f13873c0192e40263b0421a3eb1bb5504a0c085711c4c7077657a33f57f81b27b0106a678f785b8e00e62902ccf8333d10418ca42a763fa06792ec136b538f4dda9caa362c7c9e781db3325b1a87ad1adcfbce8e391f194ccf150d4bd59995267c2fe100d7a0c529f249e8650917048374e202da4b35bbcfa3aa93d17111b7cee9a818b17917e5674fa9f1a5a9b10d1bd9078a56e1413e3e1422cecf3f461711ecbc30c40ef9b6d3d15b7bb092146fcd6578e8bf591b2d5b19dfff018314e741ccd9542fa9fa91ee9245940625cc192a575bfe5b4e1497b4c2dd045c2bd40f58d2220d0f8d4d9726a33ff7924785b134a28ba79e9c17daabd6efc375775d8547db55deba32afe64251a7b7086c7e30c5c6221cb0e31f9d6506ddd606b4c4baaa97088a0d1114cd671e23c4f5db8222454cd8a0730e423d2c42f70eeddab70d107598dd884fa4102cc1a44b34b11a017fb90999c162ab9a925466cfa588e9bd471bcc8e9c8fc239c20d0f140a038963639bfdcd48ac4a985bc8e4acd61d4bc00270f1d012a05904bda5fbefac7cdec4870c327ef2dc58134a6f6998f89ca06b14b426d4b366e0c04b3673ae485ac5ed4b07cb9f3f7f071ee1112567c25cb9bd782496f8a80c51d9cfbfdae1df81be0f3994cf542b2b2e66cec46fdd011cbdaebd18b8748cb0974c67c1d0c31283df6c8862fd08876af39fa1d82493e059574b7c69671553803cd8263afcf060a06e7e4cb0411b84b0fa62e232d20b22253f25df3a44e4bb79561f1bfb44339abeab77866528b7c881d91db0859722b98962e400513a2f3ba92c84c1dbd63617abee17f9612575cfd6a85235d4d1eb01bd8cca9fbeb660dd866f79e59f0121d82e4f23b93d8e7b0d7f3ebaf2ebe59d1fbaeaebd21316ae9981b4278eaa1bc39a508de3278