[Defcon Russia #29] Алексей Тюрин - Spring autobinding

Spring MVC and

Autobinding vulns

Digital Security

Alexey GreenDog Tyurin@antyurin

Defcon Russia (DCG #7812) 2

Spring MVC


Model• Store info for the view

• Map

• “string”->object


AutobindingBinding params to object fields

Converter


Autobinding vuln

https://o2platform.files.wordpress.com/2011/07/ounce_springframework_vulnerabilities.pdf




Autobinding vuln





More magic with annotations

@ModelAttribute on a method argument

“An @ModelAttribute on a method argument indicates the argument should be retrieved from the model “…

http://docs.spring.io/spring/docs/3.1.x/spring-framework-reference/html/mvc.html






@ModelAttribute on a method“An @ModelAttribute on a method indicates the purpose of that method is to add one or more model attributes. @ModelAttribute methods in a controller are invoked before @RequestMapping methods”

http://docs.spring.io/spring/docs/3.1.x/spring-framework-reference/html/mvc.html#mvc-ann-modelattrib-method-args






@SessionAttribute for controller“The type-level @SessionAttributes annotation declares session attributes used by a specific handler. This will typically list the names of model attributes or types of model attributes which should be transparently stored in the session”


More magic with redirectsFlashAttribute“Flash attributes provide a way for one request to store attributes intended for use in another.”






@ModelAttribute on a method argument “An @ModelAttribute on a method argument indicates the argument should be retrieved from the model. If not present in the model, the argument should be instantiated first and then added to the model. Once present in the model, the argument's fields should be populated from all request parameters that have matching names.”

– is a wrong/dangerous way to get value from the model. Because: at first - retrieving , then autobinding.


Ex 2. The First School of Bulimia








PopulatingBefor in Model:

“user” ={username = “Vasia”pass = “P@ssw0rd”weight= 100}

Autobinding:

After in Model: “user” ={ username = “lalallalala”pass = “P@ssw0rd”weight= 100 }


Example 1. Justice League






Example 1. Justice League• More magic? No @ModelAttribute

• Spring MVC is IoC and too smart?




Other real examples?• Github • Articles• Nothing interesting?


Blackbox testing• Errors • Collect all parameter names

Use them for all entry pointsCheck difference

• Strange names or arrays, hashmaps

24

Q&A

Defcon Russia (DCG #7812)

https://twitter.com/antyurinhttps://github.com/grrrdog

https://twitter.com/antyurin

https://github.com/grrrdog

https://github.com/grrrdog

Internet

[Defcon Russia #29] Алексей Тюрин - Spring autobinding