External Control of System or Configuration Setting
ID |
scala.inject.scala_inject_rule_beanpropertyinjection |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Inject |
Language |
Scala |
Description
An attacker can set arbitrary bean properties that can compromise system integrity. An attacker can leverage this functionality to access special bean properties like class.classLoader that will allow them to override system properties and potentially execute arbitrary code.
Rationale
An attacker can set arbitrary bean properties that can compromise system integrity. An attacker can leverage this functionality to access special bean properties like class.classLoader that will allow them to override system properties and potentially execute arbitrary code.
The following code illustrates a vulnerable pattern detected by this rule:
// Populating a bean from request parameters lets the caller name the property to set,
// including ones the form never offered.
class ProfileBinder {
@throws[InvocationTargetException]
@throws[IllegalAccessException]
def bindOneNamedValue(bean: Nothing, request: HttpServletRequest): Unit = {
val values = new util.HashMap[String, String]()
// VULNERABLE: External Control of System or Configuration Setting
values.put("nickname", request.getParameter("nickname"))
BeanUtils.populate(bean, values)
}
@throws[InvocationTargetException]
@throws[IllegalAccessException]
@throws[InvocationTargetException]
@throws[IllegalAccessException]
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A05 : Injection.