DEV Community

Anoymask
Anoymask

Posted on

Apache Struts JVN#82782759: @JsonAnySetter Authorization Bypass and Required Protection Settings

#security #threatintel

1. Basic Information

2. Executive Summary

In Apache Struts 7.2.1 through 7.3.0 REST plugins, input authorization checks are not applied to additional fields accepted by @JsonAnySetter, which can lead to data tampering depending on the implementation. Mitigation requires updating to 7.4.0 or later and enabling the newly added check.

Because the impact depends on configurations using the REST plugin and @JsonAnySetter, the severity is rated as medium. If the ingested values are used for amounts or permissions, review the response priority based on actual business impact. This does not represent an official CVSS score.

3. Attack Flow

Input Path Based on Apache Description

This input path is described in Apache WW-5712. The final business impact is an inference dependent on application implementation.

  1. A JSON or XML request body containing additional properties that do not correspond to regular properties is sent to the target REST API.
  2. Jackson passes the additional properties to the member designated by @JsonAnySetter.
  3. The ParameterAuthorizingModule check is not applied to this path, allowing values unauthorized by @StrutsParameter to be ingested into internal objects.
  4. Inference: If subsequent processing uses these values for business decisions or storage, they could cause unauthorized processing or data modification.

4. Attacker Position and Execution Location

  • Attackers who can send requests to the target REST API are assumed. The necessity of authentication or prior privileges depends on the target API configuration.
  • @StrutsParameter is a mechanism that controls which members external inputs may be assigned to. It cannot be determined that authentication bypass is established based solely on this check omission.

5. Victim and Administrator Perspective

Victim

  • Inference: In implementations where unauthorized values are stored or processed, unintended changes may appear in order amounts, business status, or similar fields. This is an example of impact and not a symptom confirmed as an actual damage case in this issue.

Administrator

  • Inference: In configurations that log inputs or data updates, inconsistencies between unauthorized additional fields and processing results may remain. Screens and HTTP responses alone may not reveal whether internal values were set and utilized.

6. Success and Failure Conditions

Success Conditions

  • Apache Struts 7.2.1 to 7.3.0 configurations that ingest JSON or XML request bodies via the Jackson handler of the REST plugin.
  • struts.parameters.requireAnnotations=true is enabled, and @JsonAnySetter is declared on the Action or Model class receiving the request body.
  • Additional items must reach the any-setter. Properties under unauthorized parent properties are skipped at the parent stage and do not reach it.
  • The binding target must be subject to annotation-based authorization. Apache documents an exemption for a ModelDriven model pushed onto the value stack: the model's members are bindable without @StrutsParameter. Do not confuse an ordinary model object with this specific ModelDriven configuration.
  • Inference: Business-level tampering requires a path where the ingested values are used in critical processing or storage without verifying business authorization.

Failure Conditions and Mitigations

Mitigations based on JVN and Apache official any-setter documentation.

  • Update to 7.4.0 or later, and set struts.rest.anySetter.requireAnnotations=true in addition to struts.parameters.requireAnnotations=true. For compatibility, struts.rest.anySetter.requireAnnotations defaults to false, so upgrading alone does not enable the any-setter check.
  • Add @StrutsParameter(allowDynamicKeys = true) to any-setter methods or fields intended to accept inputs. Where annotation authorization applies, enabling the check rejects values for any-setters lacking this specification. An exempt ModelDriven model does not gain member-level annotation protection from these settings; its input surface and validation require separate review.
  • The default depth = 0 permits only scalar values, such as strings or numbers, beneath a dynamic key. If objects or arrays are accepted, specify the required depth and verify the impact on normal inputs. For example, depth = 1 allows one-level objects or arrays.
  • allowDynamicKeys=true is a specification allowing the acceptance of dynamic keys. Application-side validation for keys and values accepted for business purposes must be implemented separately.
  • The format specifying an any-setter in @JsonCreator parameters rejects all keys when protection is enabled, so verify the impact on normal inputs as well.
  • As a workaround, JVN recommends avoiding @JsonAnySetter in classes receiving REST inputs or validating values on the application side before storage.

7. What Happens Upon Success

  • The direct issue is that values lacking input authorization checks are set to the any-setter receiver. Checks on regular named properties continue to function, meaning not all fields or databases can be freely overwritten.
  • Inference: In a fictional order process where priceOverride, not defined as a regular property, enters additional attributes via the any-setter, and subsequent processing adopts it as the billing amount, a 10,000 yen product could be processed for 1 yen. If the server calculates the price and ignores the additional attribute, this amount tampering does not occur.
  • Inference: Storing unauthorized input values could alter records. Using them directly in business decisions could cause an impact even without a database write. The outcome depends on how the values are used and validated.

8. Observable Logs

Inference: Below are candidate logs to check within your organization. Recorded contents vary depending on application and logging configurations.

  • Email: No relevant information
  • Proxy / SWG / DNS: No relevant information
  • Endpoint / EDR: Check input validation logs, audit logs, and data update histories obtained on the application side. This depends on the recording of item names, pre- and post-change values, and request IDs, and may not be detectable by EDR alone.
  • Identity / IdP: For APIs requiring authentication, correlate the requesting account and update operations if authentication and session records exist.
  • SaaS / Cloud: No relevant information
  • Network: In configurations recording HTTP bodies, correlate target APIs, sent keys, request IDs, and responses. Access logs and response codes alone cannot confirm internal value assignment or successful tampering.

9. Attack Success Determination

Criteria for Internal Determination

  • Attack Attempt Observed (Success Unconfirmed): Criteria: Even if requests targeting the injection of unauthorized additional items are confirmed, treat the attempt as unconfirmed if assignment of the input values is unverified. This is an internal determination criterion and does not mean referenced primary sources report observed active attacks. Target: Requests to the target REST API

Record request reception, unauthorized settings in internal objects, modified stored data, and impact on business processing separately. Do not treat mere assignment of input values as information theft or session compromise.

10. Investigation Playbook

Inference: Steps for verification within the target application.

  • Trigger: Start from requests attempting to set unauthorized additional items, or inconsistencies between inputs and business state or stored values. Unknown keys alone cannot be distinguished from legitimate extension items.
  • Initial Checks: Verify target version, REST JSON/XML processing, the two requireAnnotations settings, and API exposure scope and authentication requirements.
  • Endpoint: Locate @JsonAnySetter in Actions/Models and trace from the value receiver to validation, business processing, and storage. Preserve code and configurations at the time of investigation along with necessary application logs.
  • Identity and Cloud: For APIs requiring authentication, verify whether the requesting account had permissions to modify the target data.
  • Follow-on Activity: Use request IDs or timestamps to correlate additional item ingestion with data updates and business processing results to identify impacted items and processing.
  • Containment: Restrict access or inputs to the target API as needed, and apply updates and check enablement. If unauthorized modifications are confirmed, identify their scope and recover.
  • Assessment Categories: Record request reception, unauthorized settings in internal objects, modified stored data, and impact on business processing separately. Do not treat mere assignment of input values as information theft or session compromise.

11. Defense and Detection Ideas

Inference: Consider the following verifications depending on input destinations and available records.

  • Single Events: Compare application-permitted input items and values with actual requests and update operations. Do not judge the mere presence of dynamic keys as an attack.
  • Timeline Correlation: Correlate item exploration from the same requester with subsequent modifications of critical attributes and processing results.
  • Hunting: Search code for @JsonAnySetter in classes receiving REST inputs and processes using received additional attributes.
  • Logging Gaps: If HTTP bodies, the locations where input values are assigned, and pre/post-change values are not recorded, proving past tampering is limited.
  • Priority Controls: Verify version updates and check enablement as a paired requirement in a test environment to ensure unauthorized additional items are rejected while necessary normal inputs are processed.

12. Facts / Inference / Hypothesis

Facts

  • JVN targets Apache Struts 7.2.1 to 7.3.0, describing issues and explanations when @JsonAnySetter is declared in Actions/Models receiving REST inputs and struts.parameters.requireAnnotations=true is enabled.
  • According to Apache WW-5712, keys not corresponding to regular properties do not undergo checks when passed to the any-setter. Methods, fields, and @JsonCreator parameter formats are targeted, common to Jackson JSON/XML handlers.
  • Where annotation authorization applies, unauthorized ordinary setters are rejected, and any-setters under unauthorized parents are not reached. @JsonUnwrapped is out of scope for this issue. Apache documents that a ModelDriven model pushed onto the value stack is exempt from the annotation requirement; enabling the any-setter setting does not remove that exemption.
  • Checks for any-setters can be enabled from version 7.4.0 onward, but the default value of struts.rest.anySetter.requireAnnotations is false. Specify @StrutsParameter(allowDynamicKeys = true) on permitted methods and fields.

Inference

  • Business impact varies depending on whether additional attributes are used for fee calculation, permission determination, data storage, or other functions. In addition to confirming version and input path relevance, application-side processing must be traced.
  • Determining successful tampering cannot rely solely on request records; correlating the locations where values are assigned and processing results is critical for SOC, development, and operations teams during investigations.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Open Questions and Limitations".

13. MITRE ATT&CK Mapping

The referenced material describes input authorization check omissions. Because information substantiating the objectives or intrusion phases of actual attacks is insufficient, no technique mapping is performed in this article.

14. Open Questions and Limitations

  • From the referenced primary sources, observation of active attacks exploiting this issue, damage counts, and the number of affected applications cannot be confirmed.
  • Individual application authentication requirements, modifiable business data, and impact on subsequent processing require implementation and configuration verification.
  • Paths leading to RCE, login authentication bypass, information disclosure, or service disruption are not shown in the referenced primary sources.
  • The JVN publication page and the corresponding Apache issue lack CVE numbers and official CVSS scores. This article does not assign its own CVSS score.
  • This article summarizes public sources; it does not report independent attack reproduction against real applications.

15. Impact on SOCs and Organizations

Checking whether Struts is installed is only the starting point. Trace the paths that accept external input and determine how the received values are used. Accepting additional attributes does not by itself establish that an attacker can alter critical business data; that depends on subsequent processing.

Treat both installing a fixed version and enabling the protection settings as requirements for completing remediation. SOC teams should collect request and update evidence, while development and operations teams trace input use to determine the actual impact.

16. Summary by Target Role

  • SOC: Distinguish requests targeting input injection from internal value assignment and business processing impact, and correlate with application-side records.
  • Administrators: Verify target versions and @JsonAnySetter usage destinations, update to 7.4.0 or later, enable requireAnnotations settings, and explicitly specify permitted any-setters.
  • Users: Cannot fix this through user-side operations. If unusual data modifications are noticed, report target operations and timestamps to development and operations teams.

Top comments (0)