Description

Spring Resource Injection vulnerability occurs when user-controlled input can influence file or resource access paths in Spring controllers, potentially allowing attackers to access unauthorized files or resources on the server. This can lead to information disclosure or denial of service if not properly validated.

Detection Strategy

• Check if the application uses Spring framework by looking for Controller-related imports like @Controller, @RestController annotations

• Identify controller methods that perform resource access operations like file reads/writes

• Analyze if resource paths or names can be influenced by external input without proper validation

• Report when potentially dangerous resource access patterns are found in Spring controller endpoints

Vulnerable code example

package com.example.demo

import org.springframework.web.bind.annotation.GetMapping
import org.springframework.web.bind.annotation.PathVariable
import org.springframework.web.bind.annotation.RestController

@RestController
class ResourceController {...

✅ Secure code example

package com.example.demo

import org.springframework.web.bind.annotation.GetMapping
import org.springframework.web.bind.annotation.PathVariable
import org.springframework.web.bind.annotation.RestController

@RestController
class ResourceController {...