CVE-2020-26282
BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.63%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2.
- CVSS 3.1
- 10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 4.63% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- browserup/browserup proxy
- Source
- security-advisories@github.com
References
- https://github.com/browserup/browserup-proxy/commit/4b38e7a3e20917e5c3329d0d4e9590bed9d578abPatch, Third Party Advisory
- https://github.com/browserup/browserup-proxy/releases/tag/v2.1.2Third Party Advisory
- https://github.com/browserup/browserup-proxy/security/advisories/GHSA-wmfg-55f9-j8hqThird Party Advisory
- https://securitylab.github.com/research/bean-validation-RCEExploit, Third Party Advisory
- https://github.com/browserup/browserup-proxy/commit/4b38e7a3e20917e5c3329d0d4e9590bed9d578abPatch, Third Party Advisory
- https://github.com/browserup/browserup-proxy/releases/tag/v2.1.2Third Party Advisory
- https://github.com/browserup/browserup-proxy/security/advisories/GHSA-wmfg-55f9-j8hqThird Party Advisory
- https://securitylab.github.com/research/bean-validation-RCEExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.