VYPR
← All advisories
High severityNVD Advisory· Published Feb 9, 2021· Updated Aug 3, 2024

CVE-2021-21479

CVE-2021-21479

Description

SCIMono before 0.0.19 allows Java expression injection via validation messages, leading to remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SCIMono before 0.0.19 allows Java expression injection via validation messages, leading to remote code execution.

Vulnerability

Details

SCIMono, a Java implementation of the SCIM (System for Cross-domain Identity Management) protocol, is vulnerable to Java Expression Language (EL) injection in versions prior to 0.0.19. The root cause lies in the ValidationUtil.interpolateErrorMessage method, which directly passes user-controlled error messages to ConstraintValidatorContext.buildConstraintViolationWithTemplate without sanitization [2]. This allows an attacker to inject arbitrary EL expressions that are evaluated by the Java runtime.

Exploitation

An attacker can exploit this vulnerability by sending a crafted SCIM request that triggers a validation error, embedding a malicious EL expression in the input. The expression is then interpolated and executed by the server. No authentication is required if the SCIM endpoint is exposed, making the attack surface broad [2]. The commit that fixes the issue introduces escaping of special EL characters ($, {, }) to prevent injection [3].

Impact

Successful exploitation enables remote code execution (RCE) with the privileges of the SCIMono server process. This compromises both the availability and integrity of the system, potentially allowing an attacker to read, modify, or delete data, or disrupt service [1][2].

Mitigation

The vulnerability is fixed in SCIMono version 0.0.19, available on Maven Central [4]. Users are strongly advised to upgrade immediately. No workarounds are documented.

References
  1. NVD - CVE-2021-21479
  2. Remote Code Execution in SCIMono
  3. Escape Java EL in validation message before interpolation (#117) · SAP/scimono@413b5d7
  4. Maven Repository: com.sap.scimono » scimono-server

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.sap.scimono:scimono-serverMaven
< 0.0.190.0.19

Affected products

2

Patches

1
413b5d75fa94

Escape Java EL in validation message before interpolation (#117)

https://github.com/SAP/scimonoAleydin KaraiminNov 30, 2020via ghsa
commit
1 file changed · +8 −1
  • scimono-server/src/main/java/com/sap/scimono/entity/schema/validation/ValidationUtil.java+8 −1 modified
    @@ -1,13 +1,20 @@
 
 package com.sap.scimono.entity.schema.validation;
 
+import java.util.regex.Pattern;
+
 import javax.validation.ConstraintValidatorContext;
 
 class ValidationUtil {
+  private static final Pattern EXPRESSION_LANGUAGE_CHARACTERS = Pattern.compile("([${}])");
 
   public static void interpolateErrorMessage(ConstraintValidatorContext context, String errorMessage) {
     context.disableDefaultConstraintViolation();
-    context.buildConstraintViolationWithTemplate(errorMessage).addConstraintViolation();
+    context.buildConstraintViolationWithTemplate(escapeExpressionLanguage(errorMessage)).addConstraintViolation();
+  }
+
+  private static String escapeExpressionLanguage(String text) {
+    return EXPRESSION_LANGUAGE_CHARACTERS.matcher(text).replaceAll( "\\\\$1" );
   }
 
 }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.