{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "de.codecentric:spring-boot-admin-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "de.codecentric:spring-boot-admin-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-38286"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-14T21:50:50Z",
    "nvd_published_at": "2023-07-14T05:15:09Z",
    "severity": "HIGH"
  },
  "details": "Thymeleaf through 3.1.1.RELEASE as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 allows for a sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.\n\nSpring Boot Admin 3.1.2 and 2.7.16 contain mitigations for the issue. This bypass is achived via a library called Thymeleaf which has added counter measures for this sort of bypass in version `3.1.2.RELEASE` which has explicity forbidden static access to `org.springframework.util` in expressions. Thymeleaf itself should not be considered vulnerable.",
  "id": "GHSA-7gj7-224w-vpr3",
  "modified": "2024-06-12T22:40:52Z",
  "published": "2023-07-14T06:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38286"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codecentric/spring-boot-admin/issues/2613"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thymeleaf/thymeleaf/issues/966"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codecentric/spring-boot-admin/pull/2615"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codecentric/spring-boot-admin/commit/f1f6ac6f613e1c0afc121c8989f28b4155a6797a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codecentric/spring-boot-admin/commit/f1f6ac6f613e1c0afc121c8989f28b4155a6797a#diff-1ea8b144c29588e08221597d56d8be10b4b4a210f248a83f2e837152a3d2e0d7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/codecentric/spring-boot-admin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/codecentric/spring-boot-admin/blob/master/spring-boot-admin-server/pom.xml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/p1n93r/SpringBootAdmin-thymeleaf-SSTI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spring-boot-admin sandbox bypass via crafted HTML"
}