Skip to main content

Spring MVC Data Binding (Spring4Shell class)

A Spring MVC controller binds an untrusted request onto a command object with no field allowlist, so Spring's DataBinder walks any bean property the request names. CVE-2022-22965 (Spring4Shell) used this to reach class.module.classLoader.* and write a web shell.

What Vulkro detects​

A framework-shape heuristic, not a taint proof. The detector cannot see the JDK version or servlet container, so both rules are Medium.

  • SPRING-DATABIND-001 (Medium): a @Controller / @RestController mapping method binds a @ModelAttribute command object in a file with no setAllowedFields / setDisallowedFields allowlist.
  • SPRING-DATABIND-002 (Medium, lower confidence): the same shape with an unannotated custom POJO parameter, which Spring also binds.

A file with an @InitBinder allowlist stays silent. @RequestBody (bound by Jackson, not DataBinder), @RequestParam, @PathVariable, and framework or simple types (Model, BindingResult, HttpServletRequest, String, primitives) never fire. Findings roll up under Software and Data Integrity Failures.

Non-compliant code​

@Controller
public class ProfileController {
    @PostMapping("/profile")
    public String save(@ModelAttribute Profile profile) {
        repo.save(profile);  // DataBinder walks whatever the request names
        return "ok";
    }
}

Compliant code​

@Controller
public class ProfileController {
    @InitBinder
    public void initBinder(WebDataBinder binder) {
        binder.setAllowedFields("displayName", "avatarUrl");
    }

    @PostMapping("/profile")
    public String save(@ModelAttribute Profile profile) {
        repo.save(profile);
        return "ok";
    }
}

How to fix​

  • Add a controller-local @InitBinder calling setAllowedFields(...) with exactly the properties the form may write.
  • Or bind to a purpose-built DTO with no fields beyond what the endpoint owns.
  • Keep Spring patched as well: the allowlist is a mitigation, not a substitute for the fix.

References​

See also: Confidence model.

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.

Last updated on