CVE-2022-46166: Spring Boot Admin Server RCE Vulnerability

CVE-2022-46166 Overview

CVE-2022-46166 is a Code Injection vulnerability affecting Spring Boot Admin Server, an open source administrative user interface for management of Spring Boot applications. All users who run Spring Boot Admin Server with enabled Notifiers (e.g., Teams-Notifier) and write access to environment variables via UI are affected by this critical security flaw.

The vulnerability allows attackers to inject malicious Spring Expression Language (SpEL) expressions through the notifier configuration, potentially leading to arbitrary code execution on the server. This occurs because the application uses an unsafe StandardEvaluationContext for SpEL expression parsing, which grants access to arbitrary Java classes and methods.

Critical Impact

Attackers can achieve remote code execution on affected Spring Boot Admin Server instances by exploiting SpEL injection through notifier configurations, potentially compromising the entire application and underlying infrastructure.

Affected Products

• Codecentric Spring Boot Admin versions prior to 2.6.10
• Codecentric Spring Boot Admin versions prior to 2.7.8
• Codecentric Spring Boot Admin 3.0.0 milestone releases (M1 through M5)

Discovery Timeline

• 2022-12-09 - CVE-2022-46166 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-46166

Vulnerability Analysis

This vulnerability stems from the unsafe handling of SpEL expressions within the notifier components of Spring Boot Admin Server. The application processes user-controllable input through SpEL expression parsing using StandardEvaluationContext, which provides full access to the Java type system. This design flaw enables attackers with write access to environment variables via the UI to craft malicious expressions that execute arbitrary code on the server.

The vulnerability affects multiple notifier implementations including DingTalk, Discord, and potentially others that utilize SpEL expression parsing for message templating. When an attacker modifies environment variables through the /env actuator endpoint, they can inject SpEL expressions that are later evaluated by the notifier components.

Root Cause

The root cause of CVE-2022-46166 is the use of StandardEvaluationContext in SpEL expression parsing within the notifier components. StandardEvaluationContext provides unrestricted access to Java reflection APIs, allowing arbitrary class instantiation and method invocation. This violates the principle of least privilege, as notifier templates should only require limited data-binding capabilities rather than full expression language power.

The vulnerable code pattern used StandardEvaluationContext instead of the safer SimpleEvaluationContext, which restricts the expression capabilities to only data binding operations.

Attack Vector

The attack vector is network-based and requires no authentication in configurations where the /env actuator endpoint is exposed with write access. An attacker can exploit this vulnerability through the following sequence:

1. Send a POST request to the /env actuator endpoint with a malicious SpEL expression as an environment variable value
2. Trigger a notification event that causes the affected notifier to process the malicious expression
3. The SpEL expression is evaluated with full access to Java classes, executing arbitrary code

The attack does not require user interaction and can be executed remotely against vulnerable instances.

// Security patch from DiscordNotifier.java showing migration to safe context
// Before (vulnerable):
// import org.springframework.expression.spel.support.StandardEvaluationContext;

// After (patched):
import org.springframework.expression.spel.support.DataBindingPropertyAccessor;
import org.springframework.expression.spel.support.SimpleEvaluationContext;

Source: GitHub Commit c14c3ec

Detection Methods for CVE-2022-46166

Indicators of Compromise

• Unexpected POST requests to the /env actuator endpoint containing SpEL syntax patterns (e.g., T(, #, new )
• Unusual process spawning from the Java application server
• Modifications to environment variables containing expression-like syntax with class references
• Outbound network connections from the Spring Boot Admin server to unexpected destinations

Detection Strategies

• Monitor HTTP access logs for POST requests targeting /env, /actuator/env, or similar actuator endpoints
• Implement Web Application Firewall (WAF) rules to detect SpEL injection patterns such as T(java.lang.Runtime) or #rt.exec()
• Deploy runtime application self-protection (RASP) solutions that can detect and block SpEL expression abuse
• Review application configurations for exposed actuator endpoints with write access

Monitoring Recommendations

• Enable detailed audit logging for all actuator endpoint access
• Set up alerts for environment variable modifications through the admin UI
• Monitor Java process behavior for unusual child process creation or network activity
• Implement anomaly detection for notifier-related activities and message patterns

How to Mitigate CVE-2022-46166

Immediate Actions Required

• Upgrade Spring Boot Admin Server to version 2.6.10, 2.7.8, or later immediately
• Review and restrict access to the /env actuator endpoint
• Audit current notifier configurations for any suspicious SpEL expressions
• Implement network segmentation to limit exposure of admin interfaces

Patch Information

Codecentric has released patched versions of Spring Boot Admin that address this vulnerability. The fix replaces StandardEvaluationContext with SimpleEvaluationContext combined with DataBindingPropertyAccessor, which restricts SpEL evaluation to safe data-binding operations only.

Users should upgrade to:

• Spring Boot Admin 2.6.10 or later for the 2.6.x branch
• Spring Boot Admin 2.7.8 or later for the 2.7.x branch

Refer to the GitHub Security Advisory for complete details on the fix.

Workarounds

• Disable all notifiers in Spring Boot Admin configuration if they are not required
• Block POST requests to the /env actuator endpoint at the reverse proxy or load balancer level
• Implement IP-based access controls to restrict admin interface access to trusted networks only
• Use Spring Security to require authentication for all actuator endpoints

# Configuration example - Disable write access to env endpoint in application.properties
management.endpoint.env.post.enabled=false

# Alternative: Disable actuator endpoints entirely if not needed
management.endpoints.enabled-by-default=false

# Restrict actuator exposure
management.endpoints.web.exposure.include=health,info