Background

On June 20, 2022 Spring released Spring Data MongoDB 3.4.1 and 3.3.5 to address a critical CVE report:

• CVE-2022-22980: Spring Data MongoDB SpEL Expression injection vulnerability through annotated repository query methods.

This vulnerability was originally reported on June 13, 2022.

Vulnerability

This vulnerability affects Spring Data MongoDB applications using repository query methods that are annotated with @Query or @Aggregation and use parameterized SpEL statements. A specific exploit requires non-sanitized input to the repository query method.

Wallarm Provides Protection

We tested Wallarm’s attack detection against known exploits and have confirmed that they were successfully detected and blocked. No further actions are required when working in blocking mode.

To mitigate this vulnerability when working in monitoring mode, please contact our support team if you want us to create the rule.

Feel free to reach out to support@wallarm.com if you need assistance.

Further updates will be published in Wallarm Changelog: https://changelog.wallarm.com