Server-Side Template Injection

NGHIÊM TRỌNG 10.0CVE-2020-26282 · GHSA-wmfg-55f9-j8hq · Công bố 24/12/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-26282 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 10.0) ảnh hưởng com.browserup:browserup-proxy, browserup proxy (browserup).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 4.8%, cao hơn 92.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.1.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
com.browserup:browserup-proxy Maven	`< 2.1.2`	`2.1.2`
browserup proxy browserup	`< 2.1.2`	`2.1.2`

Mô tả

Impact

A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been assigned CVE-2020-26282.

Patches

Effective Immediately, all users should upgrade to version 2.1.2 or higher.

Workarounds

None.

References

https://securitylab.github.com/research/bean-validation-RCE

For more information

If you have any questions or comments about this advisory:

Open an issue in the BrowserUp Proxy repo
Contact us via the BrowserUp website or email us at [email protected]

Mô tả của NVD

BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2.