Spring4shell in Express with Hmac Signatures

The combination of a Spring4shell-like deserialization path and Hmac Signatures in an Express service can expose an API to tampering and injection when signature verification is incomplete or applied inconsistently. Spring4shell (CVE-2022-22965) involves remote code execution through data-binding on objects such as ClassLoader, especially when the application exposes endpoints that accept serialized or structured payloads without strict validation. In Express-based integrations that rely on Hmac Signatures for request integrity, risk arises when the server uses the signature only for authentication of the secret, but still parses and binds incoming JSON or form data in a way that mirrors the vulnerable patterns seen in Java/Spring contexts when such payloads are forwarded or processed by backend services.

An Express route that validates an Hmac Signature but then forwards or reflects structured input to a downstream service (for example via HTTP requests or by populating objects that later get deserialized) can inadvertently create a path similar to Spring4shell. An attacker who knows or guesses the shared secret can forge a valid Hmac Signature, then send crafted JSON containing maliciously named fields such as class or nested objects that, if deserialized by a vulnerable library on the backend, lead to arbitrary code execution. Even if the Express layer does not perform Java deserialization, passing unchecked data to microservices or adapters that do can reproduce the Spring4shell attack chain. The Hmac Signature mechanism may also be misconfigured: accepting signatures in headers or query parameters without ensuring that the entire request body is covered, or using a weak hashing algorithm, reduces assurance that the content has not been altered.

Consider an integration where an Express API validates an Hmac Signature and then makes an HTTP call to a backend API that expects serialized Java objects. An attacker can replay a signed request with a payload designed to exploit Java deserialization gadgets. The signature appears valid, so the Express service does not block the request, and the downstream system processes malicious data. This demonstrates how the signature check alone does not prevent injection or deserialization attacks; the scanner’s checks for Input Validation and Unsafe Consumption are relevant here, as they surface missing constraints on field names, types, and size, and the absence of output validation for data forwarded to other components.

Additionally, unauthenticated LLM endpoints or verbose error messages can compound the risk by revealing stack traces or framework details that aid an attacker in tailoring payloads. The scanner’s BOLA/IDOR and Property Authorization checks can highlight whether object-level authorization is consistently applied, which complements Signature-based authentication by ensuring that even a valid signature does not grant access to unauthorized resources.

To mitigate risks when using Hmac Signatures in Express, enforce strict input validation, canonicalize the data before signing, and verify signatures on the full request body before any parsing or forwarding. Below are concrete, realistic code examples that demonstrate secure handling.

Secure Hmac verification with body hashing in Express

const crypto = require('crypto');
const express = require('express');
const app = express();

// Middleware to read raw body for Hmac verification
app.use(express.json({ verify: (req, res, buf) => { req.rawBody = buf; } }));

const SHARED_SECRET = process.env.HMAC_SECRET; // store securely

function verifyHmac(req, res, next) {
  const signature = req.get('X-API-Signature');
  if (!signature) {
    return res.status(401).json({ error: 'Missing signature' });
  }
  const hmac = crypto.createHmac('sha256', SHARED_SECRET);
  hmac.update(req.rawBody);
  const expected = 'sha256=' + hmac.digest('hex');
  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  next();
}

app.use(verifyHmac);

app.post('/api/resource', (req, res) => {
  // Validate and sanitize input after signature verification
  const { id, action } = req.body;
  if (typeof id !== 'string' || !/^[a-f0-9]{24}$/.test(id)) {
    return res.status(400).json({ error: 'Invalid id' });
  }
  if (typeof action !== 'string' || !['read', 'write'].includes(action)) {
    return res.status(400).json({ error: 'Invalid action' });
  }
  // Proceed with business logic
  res.json({ status: 'ok' });
});

module.exports = app;

Ensuring full coverage including query params and headers

function buildSignatureBase(req) {
  const method = req.method.toUpperCase();
  const path = req.path;
  const query = req.query ? new URLSearchParams(req.query).toString() : '';
  const body = req.rawBody ? req.rawBody.toString('utf8') : '';
  // Include selected headers if your scheme requires them, e.g., X-Request-ID
  return `${method}
${path}
${query}
${body}`;
}

function verifyHmacStrict(req, res, next) {
  const signature = req.get('X-API-Signature');
  if (!signature) {
    return res.status(401).json({ error: 'Missing signature' });
  }
  const base = buildSignatureBase(req);
  const hmac = crypto.createHmac('sha256', SHARED_SECRET);
  hmac.update(base);
  const expected = 'sha256=' + hmac.digest('hex');
  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  next();
}

Using the CLI and Dashboard to maintain posture

You can scan your Express endpoints with the CLI to detect missing signature coverage and input validation issues by running: middlebrick scan <url>. The results appear in the Web Dashboard, where you can track scores over time and review per-category findings. For pipelines, add the GitHub Action to fail builds if the risk score drops below your chosen threshold, and use the MCP Server to scan APIs directly from your AI coding assistant while you develop.

Remediation guidance includes enforcing strict field types, rejecting unexpected properties, avoiding deserialization of user-supplied data, and ensuring that the Hmac algorithm remains strong (e.g., SHA-256 rather than SHA-1). These steps reduce the likelihood that a forged request can reach vulnerable downstream processing, aligning with checks such as Authentication, Input Validation, and Property Authorization.