CVE-2021-37694 Code injection issue for java-spring-cloud-stream-template
Attackers can inject arbitrary code into generated Spring Cloud Stream microservices by controlling the AsyncAPI document.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-37694?
CVE-2021-37694 is a high-severity code injection vulnerability in asyncapi java-spring-cloud-stream-template, published on 11 Aug 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and all users are advised to update.
Weakness: CWE-94
Which versions are affected by CVE-2021-37694?
2 open source packages ship an affected version, including @asyncapi/java-spring-cloud-stream-template. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@asyncapi/java-spring-cloud-stream-template npm | All versions | 0.7.0 |
@asyncapi/java-spring-cloud-stream-template npm | All versions | 0.7.0 |
Products include Asyncapi Java-Spring-Cloud-Stream-Template.
How do I fix CVE-2021-37694?
Upgrade @asyncapi/java-spring-cloud-stream-template to 0.7.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-37694 being exploited?
There is no known exploitation of CVE-2021-37694 in the wild and no public exploit code.
Sources
Also known as GHSA-xj6r-2jpm-qvxp.