Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 13.23.0, 12.32.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32.0, com.ritense.valtimo:case from 13.0.0 to before 13.23.0, and com.ritense.valtimo:contract from 13.4.0 to before 13.23.0 evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. This vulnerability is fixed in com.ritense.valtimo:document 2.32.0, com.ritense.valtimo:case 13.23.0, and com.ritense.valtimo:contract 13.23.0.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- valtimo-platform valtimo
fixed in 13.23.0
- com.ritense.valtimo case
From 13.0.0 · fixed in 13.23.0
- com.ritense.valtimo contract
From 13.4.0 · fixed in 13.23.0
- com.ritense.valtimo document
From 12.0.0 · fixed in 12.32.0
- com.ritense.valtimo:documentMaven
From 12.0.0 · fixed in 12.32.0
- com.ritense.valtimo:caseMaven
From 13.0.0 · fixed in 13.23.0
- com.ritense.valtimo:contractMaven
From 13.4.0 · fixed in 13.23.0