Description

Detects potentially dangerous dynamic class loading in Kotlin Spring applications using URLClassLoader. This vulnerability could allow attackers to load and execute malicious code remotely if user-controlled input reaches the class loader, potentially leading to remote code execution.

Detection Strategy

• Check if java.net.URLClassLoader is imported in the codebase

• Look for expressions that use known dangerous class loading methods

• Verify if URLClassLoader is used in conjunction with reflection operations

• Confirm the presence of unsafe reflection patterns that could allow arbitrary class loading

Vulnerable code example

import java.net.URL
import java.net.URLClassLoader
import org.springframework.web.bind.annotation.*

@RestController
class VulnerableLoader {
    private val loader = URLClassLoader(arrayOf(), this.javaClass.classLoader)
...

✅ Secure code example

import java.io.File
import java.net.URLClassLoader
import org.springframework.web.bind.annotation.*
import org.springframework.http.ResponseEntity

@RestController
class SecureLoader {
    private val allowedJars = setOf("plugin-a.jar", "plugin-b.jar") // Whitelist of allowed JARs...