Advisories for Maven/Org.springframework.cloud/Spring-Cloud-Netflix-Hystrix-Dashboard package

2021

Improper Control of Generation of Code ('Code Injection')

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;[user-provided data], the path elements following hystrix/monitor are being evaluated as SpringEL expressions, which can lead to code execution.