Exploitation Summary
EIP tracks 6 public exploits for CVE-2016-1000027. PoCs published by artem-smotrakov, JAckLosingHeart, tina94happy.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2016-1000027, demonstrating a deserialization vulnerability in Spring Framework's HttpInvokerServiceExporter. The exploit sends a malicious serialized payload to trigger remote code execution.
Description
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Exploits (6)
This repository contains a functional PoC for CVE-2016-1000027, demonstrating a deserialization vulnerability in Spring Framework's HttpInvokerServiceExporter. The exploit sends a malicious serialized payload to trigger remote code execution.
This repository contains a functional exploit PoC for CVE-2016-1000027, demonstrating a deserialization vulnerability in Spring's HTTP Invoker. The exploit sends a crafted serialized payload to trigger remote code execution.
This repository provides a technical writeup and mitigated version of Spring Web to address CVE-2016-1000027, a remote code execution vulnerability in Java deserialization. It discusses the removal of the vulnerable `handleRequest` functionality in `HttpInvokerServiceExporter` and provides context for organizations constrained to OpenJDK 8.
The repository contains only a GitLab CI configuration and a README referencing CVE-2016-1000027 without any exploit code or technical details. It appears to be a placeholder or incomplete project.
This repository contains a functional exploit PoC for CVE-2016-1000027, demonstrating a deserialization vulnerability in Spring's HttpInvokerServiceExporter. The exploit includes an attack script that sends a crafted serialized payload to a vulnerable endpoint, along with a vulnerable Spring application setup for testing.
This repository provides a technical solution to mitigate CVE-2016-1000027 by removing the vulnerable `org.springframework.remoting` package from Spring Web 5.x. It references the GitHub advisory and issue for further context.
References (9)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H