-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework:spring-web | maven | < 6.0.0 | 6.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2016-1000027 concerns unsafe Java deserialization in Pivotal Spring Framework's HTTP invoker components.
5cbe90b2cd91b866a5a9586e460f311860e11cfa adds explicit Javadoc warnings to HttpInvokerServiceExporter.java about the dangers of Java deserialization. The method readRemoteInvocation(HttpServletRequest, InputStream) within this class is responsible for handling the input stream that is subsequently deserialized. Issue #24434 (referenced in CVE details) specifically mentions 'The readRemoteInvocation method in HttpInvokerServiceExporter.class' as problematic.2b051b8b321768a4cfef83077db65c6328ffd60f deprecates SimpleHttpInvokerServiceExporter.java, which provides similar functionality for Sun's HTTP server and also relies on Java deserialization via its readRemoteInvocation(InputStream) method.HttpInvokerServiceExporter and SimpleHttpInvokerServiceExporter extend RemoteInvocationSerializingExporter and utilize its doReadRemoteInvocation(ObjectInputStream) method to perform the actual ois.readObject() call. This method is therefore central to the vulnerability as it's where the untrusted data is deserialized.
These three functions are directly involved in the vulnerable deserialization process. The readRemoteInvocation methods are the entry points in the patched/deprecated classes that process the malicious input, and doReadRemoteInvocation is where the critical readObject() call occurs.Ongoing coverage of React2Shell