Spring Beans 0day Vulnerability

[Cantor, Scott]

On 3/30/22, 8:45 AM, "Engström Per" <per.engstrom at smhi.se> wrote:

>  I’ll take your advice and make our installation non-editable by the account running the
> application.

That doesn't do anything, if somebody can operate as the owner of the files, they can just change the mode back. You need separate accounts. The container can't run as the owner of the files.

> I also did a search for ”@InitBinder” and ”dataBinder.setDisallowedFields” as suggested by the waning notice

That is unlikely to matter. I don't find that article credible on really any level, but to the extent that they have any idea what they're talking about, they're proposing that as a mitigation. It would have to be added, it's not a question of it being there or not. And we don't use Data Binding either (because it's impractical to do that safely).

The article links to a bug that the Spring team is claiming is being spammed by unrelated comments and to the extent it's real, it's a defensive change to add a warning about the fact that Java serialization is dangerous. Any Java developer worth trusting already knows that. If that's the extent of the issue, there's nothing to this. *Hopefully* that's what we're dealing with.

-- Scott