CVE-2021-23258 Spring SPEL Expression Language Injection
Authenticated administrators or developers can execute arbitrary OS commands via Spring SPEL expressions in Crafter CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-23258?
CVE-2021-23258 is a medium-severity code injection vulnerability in Crafter CMS, published on 2 Dec 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).
Weakness: CWE-913
Which versions are affected by CVE-2021-23258?
It affects 1 product.
Products include Craftercms Crafter Cms.
How do I fix CVE-2021-23258?
No fix has been published for CVE-2021-23258 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-23258 being exploited?
There is no known exploitation of CVE-2021-23258 in the wild and no public exploit code.
Other vulnerabilities in Crafter CMS
- CVE-2017-15681 Path Traversal in Crafter CMS Crafter Studio
- CVE-2018-19907 OS Command Injection in craftercms:crafter-studio
- CVE-2017-15683 XML injection in Crafter CMS
- CVE-2017-15685 XML Injection in Crafter CMS Crafter Studio 3.0.1
- CVE-2021-23264 Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search
Sources
Also known as GHSA-58pg-75f2-3jxj.