CVE-2026-41837

Executive Summary

CVE-2026-41837 is a medium-severity vulnerability in Spring Data REST's Querydsl integration. The flaw allows an unauthenticated attacker to pass arbitrary persistent property paths as request-parameter filter keys, bypassing Jackson customizations. This can lead to information disclosure by exposing internal data structures or unintended query results. The vulnerability affects multiple versions of Spring Data REST, and no official patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Spring Data REST library, which is a Java-based framework. Organizations using affected versions should monitor for updates from the Spring team. Since no patch is available, mitigation relies on configuration changes or disabling Querydsl integration.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) suggests limited exploitation in the wild, but the lack of a patch increases risk for affected deployments.

Deep Dive & Mechanics

Spring Data REST provides a way to expose Spring Data repositories as RESTful endpoints. The Querydsl integration allows filtering results using query parameters. The vulnerability arises because the integration does not validate or sanitize the property paths provided as filter keys. An attacker can supply arbitrary property paths, including those that are normally hidden or customized via Jackson annotations.

For example, if a repository exposes an entity with a password field that is normally excluded via @JsonIgnore, an attacker could still query it using a request like:

GET /api/entities?password=test

This bypasses Jackson's serialization customizations and can expose sensitive data.

The root cause is that the Querydsl integration uses the property path directly without checking if it is allowed by Jackson's configuration.

Vulnerable vs. Patched Code

Vulnerable Code (Spring Data REST < 5.0.6):

// In QuerydslPredicateBuilder
public Predicate buildPredicate(QuerydslPredicateBuilder builder, MultiValueMap<String, String> parameters) {
    for (String key : parameters.keySet()) {
        Path<?> path = builder.getPath(key); // No validation
        // ...
    }
}

Patched Code (Hypothetical fix):

// In QuerydslPredicateBuilder
public Predicate buildPredicate(QuerydslPredicateBuilder builder, MultiValueMap<String, String> parameters) {
    for (String key : parameters.keySet()) {
        if (!isAllowedProperty(key)) { // Validate against allowed properties
            throw new IllegalArgumentException("Property not allowed: " + key);
        }
        Path<?> path = builder.getPath(key);
        // ...
    }
}

The fix would involve checking each property path against a whitelist derived from Jackson's serialization configuration.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable Spring Data REST application (e.g., version 5.0.5).
2. Identify Endpoints: Use tools like curl or Postman to discover REST endpoints.
3. Craft Payload: Send a request with a sensitive property path:

   curl -X GET "http://target:8080/api/users?password=test"
   

4. Extract Data: If the property exists, the response may include the field value.

Blue Team

1. Detection: Monitor for unusual query parameters in REST API requests.
2. Mitigation: Disable Querydsl integration if not needed:

   spring:
     data:
       rest:
         detection-strategy: annotated
   

3. Validation: Implement a custom filter to validate property paths.

Indicators of Compromise (IOCs)

• Network: HTTP requests with unexpected query parameters (e.g., password, secret, internalField).
• Logs: Spring Data REST logs showing QuerydslPredicateBuilder processing unknown properties.
• Response: API responses containing fields that should be excluded by Jackson annotations.

Detection Engineering

YARA Rule

rule CVE_2026_41837_Spring_Data_REST {
    meta:
        description = "Detects exploitation attempts of CVE-2026-41837"
        author = "Valters IT"
        date = "2026-01-01"
    strings:
        $s1 = "QuerydslPredicateBuilder" ascii nocase
        $s2 = "getPath" ascii nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-41837 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-41837 by sending arbitrary property paths
author: Valters IT
logsource:
    category: webserver
    product: spring
detection:
    selection:
        c-uri|contains:
            - "?password="
            - "?secret="
            - "?internalField="
    condition: selection
falsepositives:
    - Legitimate use of similar parameter names
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-41837 Spring Data REST Querydsl Bypass"; flow:to_server; content:"GET"; http_method; content:"?"; http_uri; pcre:"/(password|secret|internalField)=/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable Querydsl integration if not required:

   spring:
     data:
       rest:
         detection-strategy: annotated
   

2. Short-term: Implement a custom filter to validate query parameters against a whitelist.
3. Long-term: Apply the official patch once released by the Spring team.
4. Monitoring: Enable logging for all REST API requests and monitor for suspicious parameters.

Valters IT
Securing Digital Frontiers