I have done a bit more research on the vulnerability itself and want to share the details in writing to better help my own understanding of the vulerability - before you read further two things
- My java knowledge is extremely dated.
- Everything I mention here is already explained in other blogs but its more of a summation and simplification.
When you use spring-boot to build a web application you can take the request parameters (POST) and convert that into an object for easy access. (Java being an Object oriented programming language it makes sense to do this)
Java doesn’t natively support json so they can Jackson or other ways (a library to convert things to json). But it also gives the ability to convert it into a regular java object. These are called POJO ( abbr for plain old java code)
You can do this in spring-boot using @RequestMapping annotation See this example from lunasec blog post.