Description
Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Spring Cloud Netflix | Spring Cloud Netflix versions 2.2.x prior to 2.2.10.Release + and old unsupported versions | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
SecCoder-Security-Lab/spring-cloud-netflix-hystrix-dashboard-cve-2021-22053 ★ 37 · Nov 21, 2021
Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability CVE-2021-22053
-
Vulnmachines/CVE-2021-22053 ★ 1 · Nov 22, 2021
CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution http/cves/2021/CVE-2021-22053.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard | < 2.2.10.RELEASE | 2.2.10.RELEASE | GHSA-gx3f-hq7p-8fxv |