Spring4shell on Cloudflare

Spring4shell (CVE-2022-22965) leverages a data-binding bypass in Spring MVC and Spring WebFlux when running on vulnerable JDK versions. In Cloudflare Workers and Durable Objects, this commonly surfaces in custom request-handling code that deserializes JSON payloads without strict type constraints. For example, a Worker that exposes an HTTP endpoint and binds incoming JSON directly to a Java object can be tricked into evaluating expressions injected through specially crafted parameter names. A typical Cloudflare code path involves an export default { async fetch(request, env) { ... } } handler where unchecked request.json() input is forwarded to service classes that rely on Spring’s WebDataBinder. If the runtime uses a vulnerable Spring version and JDK 9+, an attacker can manipulate data binding to trigger remote code execution through gadget chains, all while appearing as a normal HTTP request logged by Cloudflare’s edge.

Detecting Spring4shell on Cloudflare requires correlating runtime behavior with dependency hygiene and input patterns. Because Workers run in isolation, traditional network-based IDS may not capture the exploit chain; instead, instrumentation must focus on deserialization entrypoints and classpath anomalies. With middleBrick, you can scan your Cloudflare-hosted API endpoints in black-box mode to identify unauthenticated attack surfaces and risky deserialization paths. For example, submit your Cloudflare Worker URL to the CLI to initiate a scan: middlebrick scan https://your-worker.example.com/api/resource. The scan runs 12 checks in parallel, including Input Validation and Property Authorization, to detect indicators of Spring4shell such as unexpected type coercion, missing validation on binder fields, and exposed endpoints that accept complex nested JSON. The OpenAPI/Swagger analysis resolves $ref definitions and cross-references them with runtime probes, highlighting risky schemas where user-controlled data reaches model binders. If your API spec defines a POST /workers/compute endpoint with a loosely typed body, middleBrick flags it and maps findings to OWASP API Top 10 and CVE-2022-22965 references, giving you prioritized remediation guidance without requiring credentials or agent installation.

Remediation on Cloudflare focuses on input hardening and avoiding reliance on Spring’s default data binding in sensitive contexts. Prefer explicit parsing with strict schemas and reject unexpected fields. For JSON handling in Workers, use a validator-first approach with libraries like zod or runtime checks instead of trusting automatic binding. If you must interoperate with Spring-based backends from a Cloudflare Worker, sanitize and whitelist fields before forwarding requests. Below is a Cloudflare Worker example that parses JSON with strict validation and blocks suspicious binder-like patterns that could enable Spring4shell exploitation:

export default {
  async fetch(request, env) {
    const body = await request.json();
    if (typeof body !== 'object' || body === null) {
      return new Response('Invalid payload', { status: 400 });
    }
    const allowed = new Set(['name', 'email', 'action']);
    for (const key of Object.keys(body)) {
      if (!allowed.has(key)) {
        return new Response('Disallowed field: ' + key, { status: 400 });
      }
    }
    // Forward only validated data to downstream services
    const upstream = new Request('https://internal-spring-app.example.com/process', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ name: body.name, email: body.email }),
    });
    const upstreamResp = await fetch(upstream);
    return new Response(upstreamResp.body, { status: upstreamResp.status });
  },
};

Additionally, audit your dependencies for vulnerable Spring versions and update to versions where data binding restrictions are enforced. For Pro plans, middleBrick’s continuous monitoring can schedule recurring scans of your Cloudflare endpoints to catch regressions, and the GitHub Action can fail CI/CD builds if a new deployment introduces risky binding definitions. These integrations help maintain secure configurations without manual checks on every change.