Server-Side Template Injection

緊急 10.0CVE-2020-26282 · GHSA-wmfg-55f9-j8hq · 24/12/2020 公開 · 17/06/2026 更新

要点

CVE-2020-26282 は com.browserup:browserup-proxy, browserup proxy (browserup) に影響する深刻度「緊急」 (CVSS 10.0) の脆弱性です。
今後30日間に悪用される確率（EPSS）：4.8%（全脆弱性の 92.0% より高い）。
対処：2.1.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
com.browserup:browserup-proxy Maven	`< 2.1.2`	`2.1.2`
browserup proxy browserup	`< 2.1.2`	`2.1.2`

概要

Impact

A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been assigned CVE-2020-26282.

Patches

Effective Immediately, all users should upgrade to version 2.1.2 or higher.

Workarounds

None.

References

https://securitylab.github.com/research/bean-validation-RCE

For more information

If you have any questions or comments about this advisory:

Open an issue in the BrowserUp Proxy repo
Contact us via the BrowserUp website or email us at [email protected]

NVD の説明

BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2.