Overview
About vulnerability
Spring HATEOAS’s internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.
Affected applications are those that have enabled the COLLECTION_JSON or UBER hypermedia type (via @EnableHypermediaSupport or auto-configuration), expose a controller accepting a RepresentationModel subclass or EntityModel as @RequestBody, and whose bound model type exposes a setter for a security-sensitive property protected only through Jackson annotations rather than by the absence of a setter.
Details
- Affected product:
- Spring
- Affected packages:
- Spring Boot @ 2.4.13 (+1847 more)