CVE-2026-40477

Executive Summary

CVE-2026-40477 is a critical Server-Side Template Injection (SSTI) vulnerability in the Thymeleaf Java template engine, affecting versions 3.1.3.RELEASE and prior. The vulnerability arises from a security bypass in the expression execution mechanisms, where the library fails to properly restrict the scope of accessible objects. This allows an unauthenticated remote attacker to bypass built-in protections and achieve SSTI if an application passes unvalidated user input directly to the template engine. The CVSS score is 9.0 (Critical), and a patch is available in version 3.1.4.RELEASE. Immediate upgrade is strongly recommended.

Supply Chain & Package Security

Thymeleaf is a widely used Java template engine distributed via Maven Central. The vulnerability affects all versions prior to 3.1.4.RELEASE. Organizations using Thymeleaf in their Java web applications should verify their dependency version and update immediately. The package is not distributed via NPM, PyPI, Go, or Ruby, but its presence in the Java ecosystem makes it a critical supply chain risk for any application using it.

CVSS Breakdown & Threat Level

• CVSS Score: 9.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it a high-priority threat for any exposed Thymeleaf-based application.

Deep Dive & Mechanics

Thymeleaf is a server-side Java template engine that processes templates containing dynamic expressions. The library includes mechanisms to prevent expression injection by restricting the objects accessible from within a template. However, in versions prior to 3.1.4.RELEASE, these protections are insufficient. The vulnerability allows an attacker to bypass the scope restrictions and access sensitive objects, such as the RequestContext, Session, or even the ClassLoader, leading to full Server-Side Template Injection (SSTI).

The core issue lies in the expression evaluation context. When a template is processed, Thymeleaf creates a context that includes variables and objects. The library attempts to restrict access to certain objects, but the restriction logic is flawed, allowing an attacker to traverse the object graph and reach sensitive objects. For example, an attacker might use expressions like ${#ctx} or ${#request} to access the context and then chain method calls to achieve remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.1.4.RELEASE):

// In the template processing, the context allows access to sensitive objects
StandardExpressionParser parser = new StandardExpressionParser();
IStandardExpression expression = parser.parseExpression(context, "${#ctx}");
Object result = expression.execute(context);
// The #ctx object is accessible, allowing further exploitation

Patched Code (3.1.4.RELEASE):

// The patched version restricts access to sensitive objects
StandardExpressionParser parser = new StandardExpressionParser();
IStandardExpression expression = parser.parseExpression(context, "${#ctx}");
Object result = expression.execute(context);
// The #ctx object is now blocked or restricted, preventing SSTI

The patch introduces stricter scope restrictions, preventing access to objects like #ctx, #request, #session, and other sensitive objects from within templates.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Thymeleaf application (version 3.1.3.RELEASE) using a simple Spring Boot application.
2. Ensure the application passes user input directly to the template engine without sanitization.

Exploitation Steps:

1. Identify an endpoint that renders user input in a Thymeleaf template.
2. Inject a malicious expression to access sensitive objects:

   ${#ctx.getClass().forName('java.lang.Runtime').getMethod('exec', #ctx.getClass().forName('java.lang.String')).invoke(#ctx.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null),'id')}
   

3. Execute the payload to achieve remote code execution.

Note: No public exploit code is available at this time. The above is a conceptual example.

Blue Team

Detection:

1. Monitor for unusual template expressions in application logs.
2. Look for patterns like ${#ctx}, ${#request}, or ${#session} in user input.
3. Use Web Application Firewall (WAF) rules to block expressions containing #ctx, #request, or #session.

Mitigation:

1. Immediately upgrade to Thymeleaf 3.1.4.RELEASE or later.
2. Validate and sanitize all user input before passing it to the template engine.
3. Implement strict input validation to reject template-like syntax.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing ${#ctx}, ${#request}, ${#session}, or similar expressions.
• Logs: Application logs showing StandardExpressionParser processing suspicious expressions.
• File System: Unexpected files created by remote code execution (e.g., /tmp/exploit.sh).
• Process: Unusual child processes spawned by the Java application (e.g., id, whoami).

Detection Engineering

YARA Rule

rule CVE_2026_40477_Thymeleaf_SSTI {
    meta:
        description = "Detects Thymeleaf SSTI exploitation attempts"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-40477"
    strings:
        $s1 = "#ctx" ascii wide nocase
        $s2 = "#request" ascii wide nocase
        $s3 = "#session" ascii wide nocase
        $s4 = "getClass()" ascii wide nocase
        $s5 = "forName" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5)
}

Sigma Rule

title: Thymeleaf SSTI Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests containing Thymeleaf SSTI payloads
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET' or 'POST'
        cs-uri-query|contains:
            - '#ctx'
            - '#request'
            - '#session'
            - 'getClass()'
            - 'forName'
    condition: selection
falsepositives:
    - Legitimate use of Thymeleaf expressions in templates
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-40477 Thymeleaf SSTI Exploitation Attempt"; flow:to_server; content:"#ctx"; http_uri; nocase; content:"#request"; http_uri; nocase; content:"#session"; http_uri; nocase; content:"getClass()"; http_uri; nocase; content:"forName"; http_uri; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Thymeleaf 3.1.4.RELEASE or later.
2. Short-term: Implement input validation to reject template-like syntax (e.g., ${...}).
3. Long-term: Use a Web Application Firewall (WAF) to block SSTI payloads.
4. Monitoring: Enable logging of all template expressions and monitor for suspicious patterns.
5. Training: Educate developers on the risks of passing user input directly to template engines.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: ECCB8A7C79008DD6911A419B] */}