Spring Boot Admins integrated notifier support allows arbitrary code execution

### Impact
All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are possibly affected.

### Patches
In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing `SimpleExecutionContext` of SpEL. This prevents the arbitrary code execution (i.e. SpEL injection).

### Workarounds
 * Disable any notifier
 * Disable write access (POST request) on `/env` actuator endpoint



Vulnerability ID: GHSA-w3x5-427h-wfq6
Aliases: CVE-2022-46166
Published: 2022-12-09 20:19:32
CWE: CWE-94
Severity rating: HIGH
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven
name: de.codecentric:spring-boot-admin
package: ecosystem: Maven
name: de.codecentric:spring-boot-admin
package: ecosystem: Maven
name: de.codecentric:spring-boot-admin