Overview
About vulnerability
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against
mutation via RFC 6902 JSON Patch (application/json-patch+json) requests.
The PUT and merge-patch (application/merge-patch+json) code paths explicitly skip these
properties during binding. The JSON Patch code path does not apply an equivalent guard, allowing
an authenticated client with PATCH access to overwrite them directly.
Overwriting the version property defeats optimistic-locking (lost-update) protection. Overwriting the identifier property can cause the subsequent repository save to silently overwrite a record belonging to a different principal (horizontal privilege escalation).
Affected applications are those that expose a Spring Data REST repository whose entity type
declares an identifier or version property that is visible to Jackson’s deserialization model
(i.e. the property has a public setter and is not explicitly excluded via @JsonIgnore).
Details
- Affected product:
- Spring
- Affected packages:
- Spring Boot @ 2.6.15 (+1776 more)