Spring4shell in Aspnet with Bearer Tokens

Spring4shell (CVE-2022-22965) is a remote code execution vulnerability in Spring Framework affecting applications using Data Binding on classpaths that include spring-web. When an ASP.NET-style API surface (e.g., an endpoint designed to accept JSON payloads and Bearer Tokens for authorization) inadvertently relies on Spring-based components—such as through interop layers, native integrations, or mixed runtime environments—the presence of vulnerable Spring dependencies can expose dangerous deserialization paths even when authentication is enforced via Bearer Tokens.

Bearer Tokens in ASP.NET are typically validated before the request reaches application logic. However, if the token validation step passes and the request is forwarded to a downstream handler that uses Spring data binding, the token context does not mitigate the risk. An attacker can send a malicious payload crafted to exploit Spring4shell (e.g., via class or module parameters) while including a valid Bearer Token in the Authorization header. The token satisfies authorization checks, but the runtime continues to process the malicious input, leading to unauthenticated or authenticated-level remote code execution depending on the deployment configuration.

In practice, this means an API secured with Bearer Tokens can still be vulnerable if the request pipeline includes components that perform unsafe data binding. For example, if an ASP.NET gateway proxies to a Spring-based microservice, or if shared libraries introduce Spring classes into the app domain, the token-based protection does not prevent exploitation. The scanner’s checks for Authentication, Input Validation, and BOLA/IDOR highlight these risks by identifying endpoints that accept tokens but still process untrusted input in data-binding routines without proper validation or type constraints.

middleBrick runs 12 security checks in parallel, including Authentication, Input Validation, and BOLA/IDOR, to detect whether token-protected endpoints still expose dangerous data-binding paths. The LLM/AI Security checks further ensure that system prompts or token-handling logic are not inadvertently exposed. By correlating OpenAPI/Swagger specs (with full $ref resolution) against runtime behavior, the tool identifies mismatches where Bearer Token usage exists on paper but insecure deserialization or binding remains in practice.

To secure ASP.NET APIs that use Bearer Tokens, ensure token validation occurs early and that no downstream data-binding logic processes untrusted input without strict validation. Use the built-in authentication and authorization filters, and avoid passing raw user input directly to model binders that may rely on reflection or external libraries.

Example of secure Bearer Token validation in ASP.NET Core:

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = "https://your-issuer.example.com",
        ValidAudience = "https://your-audience.example.com",
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("YourVerySecureKeyThatIsLongEnough"))
    };
});

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/secure-endpoint", (ClaimsPrincipal user) =>
{
    return Results.Ok(new { message = $"Hello, {user.Identity?.Name ?? "unknown"}" });
}).RequireAuthorization();

app.Run();

In this example, the Bearer Token is validated before the endpoint executes. Ensure that no controller actions accept raw input for data binding without explicit validation. For JSON payloads, prefer explicit DTOs with strict type constraints and avoid dynamic or loosely typed models that may be exploited via Spring4shell-style injection vectors.

Additionally, apply the following practices:

• Use [ApiController] and model validation attributes (e.g., [Required], [StringLength]) to enforce input rules.
• Disable automatic model binding for sensitive endpoints using [BindNever] or custom filters where appropriate.
• Audit dependencies to ensure no vulnerable Spring components are present in the runtime environment, even indirectly.

middleBrick’s CLI tool allows you to validate these configurations by scanning from the terminal with middlebrick scan <url>, while the GitHub Action can add API security checks to your CI/CD pipeline to fail builds if risk scores drop below your defined threshold. The MCP Server enables scanning APIs directly from your AI coding assistant, helping you detect insecure patterns before deployment.