CVE-2016-1000027 PoC — Vmware Spring Framework 代码问题漏洞

Source

https://github.com/yihtserns/spring-web-without-remoting

Associated Vulnerability

Title: Vmware Spring Framework 代码问题漏洞 (CVE-2016-1000027)
Description:Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

Description

Spring Web 5.x with `org.springframework.remoting` package removed, to fix CVE-2016-1000027.

Readme

# spring-web-without-remoting
Spring Web 5.x with `org.springframework.remoting` package removed, to fix <a href="https://github.com/advisories/GHSA-4wrc-f8pq-fpqp">CVE-2016-1000027</a>.

For more info, see <a href="https://github.com/spring-projects/spring-framework/issues/24434">spring-projects/spring-framework #24434</a>.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →