Thymeleaf Expression Execution Security Bypass Vulnerability Allowing Server-Side Template Injection

A security bypass vulnerability has been identified in the Thymeleaf Java template engine, affecting versions through 3.1.3.RELEASE. This vulnerability arises from improper restrictions in the expression execution mechanisms, allowing potentially sensitive objects to be accessed from within templates. If unvalidated user input is passed directly to the template engine, an unauthenticated remote attacker can exploit this flaw to achieve Server-Side Template Injection (SSTI).

Impact

Exploitation of this vulnerability allows for Server-Side Template Injection (SSTI), where an attacker can inject and execute arbitrary code on the server via the template engine.

Remediation

Users are advised to upgrade to Thymeleaf version 3.1.4.RELEASE, which addresses this vulnerability. For applications using Thymeleaf with Spring, the same version should be applied.