high8.0
CVE-2022-46166
Spring Boot Admins integrated notifier support allows arbitrary code execution
Impact
### Impact All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are possibly affected. ### Patches In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing `SimpleExecutionContext` of SpEL. This prevents the arbitrary code execution (i.e. SpEL injection). ### Workarounds * Disable any notifier * Disable write access (POST request) on `/env` actuator endpoint
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | de.codecentric:spring-boot-admin | < 2.6.10 | 2.6.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Codecentric | Spring Boot Admin | before 2.6.10 from 2.7.0 before 2.7.8 Version 3.0.0 |