CVE-2021-22053: Code Injection in spring-cloud-netflix-hystrix-dashboard
Summary
CVE-2021-22053: Code injection in spring-cloud-netflix-hystrix-dashboard. Affects org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard versions < 2.2.10.RELEASE. Fixed in 2.2.10.RELEASE. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spring-cloud-netflix-hystrix-dashboard package is a part of the Spring Cloud Netflix project, which provides integration between Spring Cloud and Netflix OSS components. It includes a Hystrix Dashboard that visualizes the circuit breaker and metrics data for Hystrix-enabled applications. The package allows users to monitor and manage Hystrix circuits in their applications.
Vulnerability Detail
Applications using the spring-cloud-netflix-hystrix-dashboard are vulnerable to code injection. When a request is made at /hystrix/monitor;[user-provided data], the path elements following hystrix/monitor are evaluated as SpringEL expressions. This allows an attacker to submit malicious code within the request URI path, leading to code execution. The vulnerability has a CVSS score of 7.6 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L). Exploitation of this vulnerability can result in unauthorized code execution and potential compromise of the affected system.
How To Fix
Latest published version: 2.2.10.RELEASE as of 23 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a temporary workaround is to restrict user input and sanitize the request URI path. This can be done by validating and filtering user-provided data before using it in the request path. Implement input validation and sanitization mechanisms to prevent the execution of arbitrary code.
Conclusion
The spring-cloud-netflix-hystrix-dashboard package is vulnerable to code injection, which can lead to unauthorized code execution. It is crucial to upgrade to version 2.2.10.RELEASE or later to mitigate this vulnerability. If immediate upgrade is not possible, implement input validation and sanitization mechanisms to prevent code injection. For further assistance on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the affected system. Depending on the privileges of the application, this can lead to unauthorized access, data leakage, or further compromise of the system.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fix or workaround to mitigate the risk of exploitation.
No, versions up to and including 2.2.9.RELEASE of the spring-cloud-netflix-hystrix-dashboard package are affected. Versions 2.2.10.RELEASE and later include a fix for the vulnerability.
Yes, this vulnerability can be exploited remotely. An attacker can send a specially crafted request to the vulnerable application, triggering the code injection and executing arbitrary code.
Yes, this vulnerability has a CVSS score of 7.6 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L). The CVSS score provides a standardized measure of the vulnerability's severity.
