Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
codecentric/spring-boot-admin
master @ 6e9bc86
19
Fixes
1
CVEs
HIGH
Peak severity
52.9%
Coverage
Highlights
Information Disclosure: 5 prior fixes. Scrutinize any change in this area.
spring-boot-admin-server: most-fixed (6 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: Unsafe evaluation of SpEL expressions within notification integrations (such as Feishu) can lead to arbitrary code execution if user-controlled input reaches the expression evaluation context. Developers must enforce strict, safe evaluation contexts instead of the default standard context.
Server-Side Template Injection (SSTI): Using powerful resource-resolving template engines (like SpringResourceTemplateResolver) in notification builders allows attackers to trigger arbitrary local or remote resource loading. Restricted classloader-based template resolvers must be used to neutralize this behavior.
Cross-Site Scripting (XSS): The admin UI formats and renders objects fetched directly from managed endpoints. Failing to sanitize these inputs before rendering them with v-html allows compromised or malicious client applications to execute scripts in the context of the admin console.