Vulnerability Directory | CVE-2022-31679 | Spring

Overview

Spring Data REST automatically exposes Spring Data repositories as RESTful endpoints, providing HATEOAS driven HTTP resources over JPA entities with minimal boilerplate.

A vulnerability (CVE-2022-31679) exists in Spring Data REST's handling of JSON Patch requests (application/json-patch+json). The framework fails to enforce Jackson serialization annotations when applying patch operations to domain objects. This is an instance of Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915), where an attacker exploits insufficient validation of user-supplied input to override variables that should be protected.

In this case, entity fields hidden by @JsonIgnore or @JsonIgnoreProperties can still be modified via carefully crafted JSON Patch requests. An attacker understanding the domain model can write to sensitive properties like passwords or PII that were intentionally hidden from the REST interface.

This issue spans multiple release trains of the spring-data-rest-webmvc and spring-data-rest-core packages.

‍

Details

Module Info

Product: Spring Data REST
Affected packages: spring-data-rest-core, spring-data-rest-webmvc
Affected versions: >=3.5.0 <=3.5.12, >= 3.6.0 < 3.6.7, >= 3.7.0, < 3.7.3
GitHub repository: https://github.com/spring-projects/spring-data-rest
Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-rest-core
Package manager: Maven
Fixed In: NES for Spring Data REST v3.5.13

‍

Vulnerability Info

This vulnerability affects applications using Spring Data REST that allow HTTP PATCH operations on repository resources. The problem is that the JSON Patch processor modifies domain objects directly, ignoring Jackson's annotation based visibility rules.

Exploitation is possible when:

The application exposes JPA entities via Spring Data REST.
Entity fields are marked non-serializable with @JsonIgnore or @JsonIgnoreProperties.
The application accepts application/json-patch+json HTTP PATCH requests.
The attacker knows the entity's field names.

An attacker can send a JSON Patch replace operation targeting a protected field. Since the patch processor bypasses Jackson's controls, the hidden field is modified in the data store, even though standard REST serialization would exclude it.

While rated Low severity (CVSS 3.7) due to confidentiality impact, the practical risk is higher if hidden fields contain credentials, as the flaw in the affected code also permits unauthorized writes.

‍

Mitigation

Only recent versions of Spring Data REST receive community security patches. Older release trains (such as the 3.5.x line used with Spring Boot 2.5.x) have no publicly available fix. For more information, see here.

Users of the affected components should apply one of the following mitigations:

Upgrade to community-supported versions of Spring Data REST

If HTTP PATCH support is not required for your application, disable it as a workaround. Spring Data REST allows you to restrict which HTTP methods are exposed either globally or per-repository. You can disable PATCH for all resources using the ExposureConfiguration API:

@Configuration
public class RestConfig implements RepositoryRestConfigurer {
  @Override
  public void configureRepositoryRestConfiguration(RepositoryRestConfiguration config, CorsRegistry cors) {
    ExposureConfiguration exposureConfig = config.getExposureConfiguration();

    exposureConfig.withItemExposure((metadata, httpMethods) -> httpMethods.disable(HttpMethod.PATCH));
  }
}