Spring Integration vulnerabilities

In Spring Integration, when an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers copied from whichever message was most recently consumed upstream. Affected versions include 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers bindings into another message's script evaluation or throwing spurious exceptions. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.

In Spring Integration, an operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Affected versions include 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Affected versions: Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders.

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution.

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Affects Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12.

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Affects Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Affects Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Affects Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files outside the configured local directory on the Spring Integration client filesystem. Affected versions: 7.0.0-7.0.4, 6.5.0-6.5.8, 6.4.0-6.4.11, 6.3.0-6.3.14, 5.5.0-5.5.20.