Expression Language Injection Affecting org.hibernate.validator:hibernate-validator package, versions [0,9.2.0.Beta1)

org.hibernate.validator:hibernate-validator is a Hibernate Validator Engine Relocation Artifact.

Affected versions of this package are vulnerable to Expression Language Injection in the ParameterTermResolver class, whose resolveExpression method converts a message parameter value to a string with toString and Arrays.toString without escaping, so the result is carried into the subsequent Expression Language pass of AbstractMessageInterpolator and re-evaluated. An attacker can exhaust server resources by submitting a collection whose duplicate elements render as an Expression Language fragment, which UniqueElementsValidator binds into the duplicates message parameter and which is then evaluated during construction of the violation message. This requires the application to apply @UniqueElements, or another constraint binding attacker-influenced data through addMessageParameter, to input the attacker controls, and the standard constraint message feature level of BEAN_PROPERTIES bounds evaluation to bean property access rather than arbitrary method calls.

This vulnerability can be avoided by setting hibernate.validator.constraint_expression_language_feature_level to none, which disables Expression Language interpolation of constraint messages entirely at the cost of any messages that rely on it.

• GitHub Commit
• Red Hat Bugzilla Bug