Spring Boot Admins integrated notifier support allows arbitrary code execution

Vulnerability

Analysis

CVE-2022-46166 is an arbitrary code execution vulnerability in Spring Boot Admin Server, an open-source administrative UI for managing Spring Boot applications [1]. The flaw resides in the notifier component, which sends alerts (e.g., Teams-Notifier). When a user with write access to environment variables via the UI modifies a Spring Boot application's environment, the notifier's template engine evaluates user-controlled input without proper sanitization, leading to SpEL (Spring Expression Language) injection [2].

Exploitation

To exploit this vulnerability, an attacker must have write access to the /env actuator endpoint through the Admin UI, and at least one notifier must be enabled. The attacker can then set an environment variable containing a malicious SpEL expression. When the notifier processes an event, it evaluates the expression, resulting in arbitrary code execution on the server [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the Spring Boot Admin Server. This can lead to full compromise of the server, including data exfiltration, lateral movement, or disruption of monitored applications [2].

Mitigation

The vulnerability is fixed in Spring Boot Admin versions 2.6.10 and 2.7.8 by implementing a SimpleExecutionContext for SpEL, which prevents injection [2]. Users unable to upgrade should disable any notifier or disable write access (POST requests) on the /env actuator endpoint as a workaround [2].