Pivotal Spring Framework up to 5.3.16 deserialization

Summaryinfo

A vulnerability categorized as very critical has been discovered in Pivotal Spring Framework up to 5.3.16. This impacts an unknown function. Such manipulation leads to deserialization. This vulnerability is referenced as CVE-2016-1000027. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in Pivotal Spring Framework up to 5.3.16. It has been rated as very critical. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

The weakness was published 04/21/2023. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2016-1000027 since 07/18/2016. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/25/2025).

The exploit is available at bugzilla.redhat.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 214596 (Oracle Business Intelligence Publisher 7.0 / 7.6 (OAS) (January 2025 CPU)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (214596). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Pivotal

Name

• Spring Framework

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11
• 5.3.12
• 5.3.13
• 5.3.14
• 5.3.15
• 5.3.16

License

• commercial

Website

• Vendor: https://pivotal.io/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion