Version Property Loss in Spring Data REST via HTTP PUT Request

Executive Summary

This vulnerability affects Spring Data REST versions 3.7.20 and earlier, 4.0.0 to 4.4.15, 4.5.0 to 4.5.12, and 5.0.0 to 5.1.0. It allows authenticated users with PUT access to modify the version property of immutable aggregates, bypassing optimistic-locking protections. This happens because Spring Data REST does not preserve the persisted version property when handling PUT requests for immutable types or polymorphic subtype changes.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your Spring Data REST application uses immutable aggregate roots with version properties exposed to PUT requests. Review application logs for PUT requests modifying version fields on immutable types. Check for concurrent modification anomalies or stale writes in data repositories.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables stale writes and silent overwrites of concurrent updates. An attacker could submit a version value that overwrites the stored version, leading to data corruption or loss. Affected applications are those exposing a Spring Data REST repository with an immutable aggregate root containing a version property visible to Jackson's deserialization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized data modifications. The issue allows authenticated users to bypass optimistic-locking protections and overwrite stored data versions, potentially leading to stale writes or silent data corruption. Such unauthorized changes may violate integrity requirements under GDPR's data accuracy principle and HIPAA's integrity safeguards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Spring Data REST to fixed versions: 3.7.21, 4.4.16, 4.5.13, 5.0.7, or 5.1.1. No additional mitigation steps are required after upgrading. Ensure all dependencies are updated to prevent exposure.

Useful 0 Not Useful 0