Description
A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dromara | warm-flow | 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.dromara.warm:warm-flow-plugin-modes-sb | < 1.8.5 | 1.8.5 | GHSA-822v-8w6h-5jxp |
References
- VDB-356989 | Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection vdb-entry technical-description
- VDB-356989 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #793322 | Dromara warm-flow <= 1.8.4 Code Injection third-party-advisory
- https://gitee.com/dromara/warm-flow/issues/IHURVQ exploit issue-tracking
- https://gitee.com/dromara/warm-flow/ product