Spring Framework insecurely handles PropertyDescriptor objects with data binding

ronjor · Apr 1, 2022

Vulnerability Note VU#970766
Original Release Date: 2022-03-31 | Last Revised: 2022-03-31

Description
The Spring Framework is a Java framework that can be used to create applications such as web applications. Due to improper handling of PropertyDescriptor objects used with data binding, Java applications written with Spring may allow for the execution of arbitrary code.
Click to expand...

reasonablePrivacy · Apr 1, 2022

Dangerous stuff

In certain configurations, exploitation of this issue is straightforward, as it only requires an attacker to send a crafted HTTP request to a vulnerable system. However, exploitation of different configurations will require the attacker to do additional research to find payloads that will be effective.
This vulnerability allows an unauthenticated attacker to execute arbitrary code on the target system.
Click to expand...

https://www.praetorian.com/blog/spring-core-jdk9-rce/

ronjor · Apr 2, 2022

Explaining Spring4Shell: The Internet security disaster that wasn’t

Dan Goodin - 4/1/2022
Vulnerability in the Spring Java Framework is important, but it's no Log4Shell.
Click to expand...

Log in or Sign up

Spring Framework insecurely handles PropertyDescriptor objects with data binding

ronjor Global Moderator

reasonablePrivacy Registered Member

ronjor Global Moderator

Log in or Sign up

Spring Framework insecurely handles PropertyDescriptor objects with data binding

ronjor Global Moderator

reasonablePrivacy Registered Member

ronjor Global Moderator

Useful Searches