CVE-2022-22980

Overview

Spring Data MongoDB is part of the Spring Data project and provides integration with the MongoDB document database. It simplifies data access and mapping for Java applications using MongoDB.

An Improper Input Validation vulnerability (CVE-2022-22980) has been identified in Spring Data MongoDB. This vulnerability can allow an attacker to manipulate query behavior when user-controlled input is used to construct MongoDB queries.

Improper Input Validation occurs when untrusted input is not correctly sanitized or validated before being used in operations. In this case, specially crafted input may influence how queries are constructed and executed, potentially leading to unauthorized data access.

This issue affects multiple versions of Spring Data MongoDB.

Details

Module Info

• Product: spring-data-mongodb
• Affected packages: solr-core
• Affected versions: => 5.3.0, <= 9.1.0
• GitHub repository: https://github.com/spring-projects/spring-data-mongodb/
• Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-mongodb
• Package manager: Maven

Vulnerability Info

This flaw affects applications that use Spring Data MongoDB repositories or template-based query construction with user-provided input.

The vulnerability is triggered when applications use @Query or @Aggregation-annotated repository methods that include SpEL (Spring Expression Language) expressions with parameter placeholders for value binding. If untrusted input is passed into these expressions without proper sanitization, it may influence how the query is constructed and executed.

Under these conditions, specially crafted input can alter the intended structure or behavior of a MongoDB query. This may allow an attacker to:

• Modify query criteria in unintended ways
• Inject or manipulate query expressions through SpEL evaluation
• Bypass application-level filtering or access controls
• Access or return data that should not be exposed

Applications are particularly at risk when user-controlled input is directly incorporated into SpEL-based query definitions without strict validation or constraints.

‍

Steps To Reproduce

1. Use an application with Spring Data MongoDB < 3.3.5 or < 3.4.1 that utilizes @Query or @Aggregation annotations with SpEL expressions.
2. Identify an endpoint that passes unsanitized user input directly into a repository method using a SpEL-based query.
3. Submit a crafted HTTP request containing a malicious SpEL payload (e.g., T(java.lang.Runtime).getRuntime().exec("...")) within the vulnerable parameter.
4. Observe the execution of the arbitrary command or unauthorized data retrieval, indicating successful SpEL injection.

Mitigation

Only recent versions of Spring Data MongoDB are community-supported. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade Spring Data MongoDB to versions 3.4.1, 3.3.5 (or newer) to ensure SpEL expressions in @Query and @Aggregation annotations are properly handled.
• Refactor Repository Queries to use parameter binding (e.g., ?0) instead of SpEL placeholders (e.g., :#{#...}) when processing untrusted user input.
• Apply the Principle of Least Privilege to the MongoDB database user to limit the impact of potential unauthorized data access or command execution.
• Upgrade affected applications to supported versions of Spring Data MongoDB
• Leverage a commercial support partner like HeroDevs for post-EOL security support.