Описание
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
Отчет
This flaw was originally reported as resulting in information disclosure only, and was therefore assessed as having low security impact. On this basis, it was planned that future updates to JBoss products may address this flaw. New research [0] has now shown that this flaw can lead to remote code execution. The security impact has been re-assessed as important, and Red Hat is now working on patches for all affected products. [0] http://danamodio.com/application-security/discoveries/spring-remote-code-with-expression-language-injection/
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss BRMS 5 | spring | Affected | ||
| Red Hat JBoss Enterprise Web Server 1 | eap-5 | Affected | ||
| Red Hat JBoss Enterprise Web Server 1 | eap-6 | Affected | ||
| Red Hat JBoss Portal 5 | spring | Affected | ||
| Red Hat JBoss SOA Platform 5 | spring | Affected | ||
| JBEWP 5 for RHEL 5 | aopalliance | Fixed | RHSA-2013:0196 | 24.01.2013 |
| JBEWP 5 for RHEL 5 | apache-cxf | Fixed | RHSA-2013:0196 | 24.01.2013 |
| JBEWP 5 for RHEL 5 | bsh2 | Fixed | RHSA-2013:0196 | 24.01.2013 |
| JBEWP 5 for RHEL 5 | glassfish-jaxb | Fixed | RHSA-2013:0196 | 24.01.2013 |
| JBEWP 5 for RHEL 5 | google-guice | Fixed | RHSA-2013:0196 | 24.01.2013 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.4 Medium
CVSS2
Связанные уязвимости
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, ...
Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework
EPSS
6.4 Medium
CVSS2