java-framework-audit

Java framework-specific vulnerability source code auditing

The essence of framework vulnerabilities falls into two categories: framework's own defects(known CVEs, fixed by upgrading) andframework misuse(configuration/coding defects caused by developers' insufficient understanding of framework security mechanisms). The core issue this skill focuses on is: how the code of the audited project triggers these known framework defect patterns.

In-depth reference

• Detailed explanation of vulnerability patterns in 5 major frameworks/components → references/framework-vulns.md

---

Quick reference table for 5 major frameworks/components

Framework/Component	Core risk	Primary search keywords	Typical severity
Spring full stack	SpEL injection / Actuator exposure / Mass Assignment	@Value SpelExpression Actuator management.endpoints	High-Critical
Struts2	OGNL injection / Content-Type parsing	struts.xml ActionSupport ValueStack ognl	Critical
Shiro	RememberMe deserialization / URI bypass	setCipherKey rememberMe ShiroFilterChain	Critical
FastJSON/Jackson/Gson	Deserialization autotype / polymorphic	JSON.parseObject JSON.parse enableDefaultTyping @JsonTypeInfo	Critical
MyBatis	${} SQL concatenation injection	${ in Mapper XML / @Select @Update annotations	High

Spring full stack auditing key points

• Spring MVC parameter binding (Mass Assignment): @ModelAttribute automatically binds request parameters to object fields. If the entity class contains role/isAdmin/price and other sensitive fields and does not use @InitBinder + WebDataBinder.setAllowedFields() for whitelisting, attackers can overwrite sensitive attributes by adding extra parameters
• Spring Boot Actuator: Check management.endpoints.web.exposure.include configuration. High-risk endpoints: /actuator/env(leaks configuration + restart RCE),/actuator/jolokia(JNDI injection),/actuator/heapdump(extract keys/passwords from heap dump),/actuator/gateway/routes(Gateway route injection)
• SpEL injection: 5 common injection points — @Value("#{externInput}")、@Cacheable(key="#root.args[0]") concatenating user input,@PreAuthorize / @PostAuthorize expression concatenation,ExpressionParser.parseExpression() directly parsing external input, SpEL in Spring Data @Query SpEL in ?#{...}
• Spring Cloud Gateway: CVE-2022-22947 type vulnerability, SpEL expressions embedded in route Predicate/Filter configuration, dynamically registering malicious routes through Actuator /gateway/routes dynamic registration of malicious routes
• Spring Security configuration pitfalls: antMatchers incorrect order (loose rules before strict rules override them),.permitAll() too broad scope, path matching inconsistent with Servlet path (such as trailing slash /admin vs /admin/）

Struts2 auditing key points

• OGNL injection: user-controllable data enters OGNL expression evaluation. Parameter names/values enter ParametersInterceptor through ValueStack, if SecurityMemberAccess restrictions are not strict, arbitrary code can be executed
• Content-Type parsing: Jakarta Multipart parser's incorrect handling of abnormal Content-Type leads to OGNL execution (S2-045), the filename field of Content-Disposition is the same (S2-046)
• ActionMapping parameter prefix: method:(call arbitrary Action methods),redirect:/redirectAction:(OGNL injection). Check struts.enable.DynamicMethodInvocation and struts.mapper.alwaysSelectFullNamespace
• version CVE mapping: Struts 2.0.x~2.3.x is a high-risk range; S2-001/005/009/012/013/015/016/019/032/033/037/045/046/048/052/053/057/059/061/062 are all at the remote code execution level

Shiro Audit Key Points

• RememberMe Deserialization: Shiro 1.2.4 and earlier versions use a hardcoded AES key kPH+bIxk5D2deZiIxcaaaA== to encrypt the RememberMe Cookie. Even after upgrading, if developers use a custom but predictable/leaked key, the risk still exists
• URI Bypass: Semicolon truncation /admin/;.js bypasses Shiro but is routed normally by Spring,/..;/admin path traversal, double URL encoding, mixed case to bypass the Filter. The core reason is that Shiro's URL matching is inconsistent with the parsing rules of the backend framework (Spring/Servlet)
• Version CVEs: CVE-2016-4437 (hardcoded key), CVE-2020-1957 (/toLogin;/../admin bypass), CVE-2020-11989 (double encoding), CVE-2021-41303 (path normalization bypass)

FastJSON/Jackson/Gson Audit Key Points

• FastJSON: JSON.parseObject(input) or JSON.parse(input) supports by default the @type field to specify the deserialization class. The autotype blacklist is continuously bypassed with version upgrades (1.2.24→1.2.47→1.2.68→1.2.80).Feature.SupportNonPublicField when enabled allows setting private fields. 1.2.83+ introduces safeMode to completely disable autotype
• Jackson: ObjectMapper.enableDefaultTyping() or ObjectMapper.activateDefaultTyping() enables global polymorphic deserialization, equivalent to a global RCE entry point. Field-level @JsonTypeInfo(use=Id.CLASS) or @JsonTypeInfo(use=Id.MINIMAL_CLASS) is equally dangerous
• Gson: It does not support polymorphic deserialization by itself and is relatively safe. However, in a custom TypeAdapter / JsonDeserializer if Class.forName is used to load a user-specified class name, it introduces risk
• Detection Methods: Search for JSON.parseObject / JSON.parse（FastJSON）、enableDefaultTyping / activateDefaultTyping / @JsonTypeInfo(Jackson), custom TypeAdapter（Gson）

MyBatis Audit Key Points

• ${} vs #{}: ${} is direct string concatenation (equivalent to String.format），#{} is prepared statement parameter binding. In Mapper XML and @Select/@Update/@Delete/@Insert annotations, ${} are all SQL injection entry points
• In dynamic SQL, ${}: <if test="sort != null">ORDER BY ${sort}</if>、<where> and <foreach> within the ${} tag, the use of
• ORDER BY / LIKE / IN Safe Practices: ORDER BY cannot use #{} prepared statements; column names should be validated against a whitelist; LIKE should be rewritten as LIKE CONCAT('%', #{keyword}, '%'); IN should use <foreach collection="ids" item="id">#{id}</foreach>
• Two Entry Points: Mapper XML files (*Mapper.xml) and annotation mode (@Select("SELECT * FROM ${table}")), both need to be audited

Detection Checklist

• The frameworks used by the project and their exact version numbers have been confirmed, and known CVEs have been compared
• The exposure scope of Spring Actuator endpoints has been checked, and whether sensitive endpoints require authentication has been confirmed
• The 5 scenarios of SpEL injection have been searched and investigated one by one
• Spring MVC @ModelAttribute Whether the entity bound by
• For Struts2 projects, the OGNL security configuration and SecurityMemberAccess settings have been confirmed
• Shiro setCipherKey Whether default or weak keys are used, and whether the Filter Chain's URI matching is consistent with the actual routing
• The FastJSON version and autotype configuration have been confirmed, and whether Jackson has enabled enableDefaultTyping
• In all Mapper XML and @Select annotations, ${} usage has been marked, and unavoidable scenarios have been confirmed to have whitelist protection
• Dynamic SQL tags (<if> / <where> / <foreach>) in the ${} has been checked
• All discovered framework vulnerabilities have EVID_* evidence chains (Source→Sink path + version/configuration evidence)