Overview
About vulnerability
An operator who callsJdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. setBeanClassLoader, invoked by the container as part of BeanClassLoaderAware, replaces the store’s deserializing converter with a new permit-all instance, but the row mapper retains its original reference and continues using it.
The allow-list configured through addAllowedPatterns is therefore never consulted, and the operator has no indication that it was bypassed.
An attacker who can write bytes into INT_MESSAGE.MESSAGE_CONTENT achieves Java-deserialization RCE despite the operator believing an allow-list is enforced.
Details
- Affected product:
- Spring
- Affected packages:
- Spring Integration @ 6.4.9 (+570 more)