How to avoid Insecure Binder Configuration in JAVA

What is API ABUSE? 😥

An API is a contract between a caller and a callee. The most common forms of API abuse are caused by the caller failing to honor its end of this contract. For example, if a program fails to call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion.
Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller abuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated.

Abstract 🙄

The framework binder used for binding the HTTP request parameters to the model class has not been explicitly configured to allow, or disallow certain attributes

Explanation 🤓

To ease development and increase productivity, most modern frameworks allow an object to be automatically instantiated and populated with the HTTP request parameters whose names match an attribute of the class to be bound. Automatic instantiation and population of objects speeds up development, but can lead to serious problems if implemented without caution.

Any attribute in the bound classes, or nested classes, will be automatically bound to the HTTP request parameters. Therefore, malicious users will be able to assign a value to any attribute in bound or nested classes, even if they are not exposed to the client through web forms or API contracts.

The vulnerability 😩

public class MyClasss implements Serializable {
  // some logic
}

The solution 😊

Jackson provides an annotation that can be used on class level (JsonIgnoreProperties).

So simple, just add @JsonIgnoreProperties(ignoreUnknown = true) before the class.

Add the following to the top of your class (not to individual methods):

@JsonIgnoreProperties(ignoreUnknown = true)
public class MyClasss implements Serializable {
  // some logic
}

👋

Comments

[vpatil1311]

Hi Marcos, if the model class is used in both POST and PUT calls, how can I avoid certain fields from SET only in case of PUT operation.
Thanks,Vinay