Spring Beans 0day Vulnerability

[Cantor, Scott]

If anyone hasn't seen it, the official "pre-announcement" is at [1].

They have already released a fixed version and we wll be releasing a 4.1.6 patch today with the update which will obviously be announced in the usual way. If somebody is in a super big hurry, building a from source version of the IdP just involves checking out the maint-4.1 branch and updating the Spring version in idp-parent/pom.xml

We do not know, nor see any practical way to know, if the IdP is actually vulnerable to the issue. We don't use any of the data binding functionality involved, but MVC has too much implicit behavior to be certain of anything. They mention Tomcat also, but I don't have any evidence that Jetty wouldn't be attackable too.

 We don't want to spend a lot of time right now on trying to prove a negative, but we probably will look into what options we might have for outright blocking some of this kind of behavior in future versions.

Of course any Spring MVC experts are always welcome to weigh in privately or otherwise if they have suggestions. 

-- Scott

[1] https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement