-The Spring Framework provides an abstract base class RemoteInvocationSerializingExporter
-for creating remote service exporters.
-A Spring exporter, which is based on this class, deserializes incoming data using ObjectInputStream.
-Deserializing untrusted data is easily exploitable and in many cases allows an attacker
-to execute arbitrary code.
-
-The Spring Framework also provides two classes that extend RemoteInvocationSerializingExporter:
-
HttpInvokerServiceExporter
-SimpleHttpInvokerServiceExporter
-
-These classes export specified beans as HTTP endpoints that deserialize data from an HTTP request
-using unsafe ObjectInputStream. If a remote attacker can reach such endpoints,
-it results in remote code execution in the worst case.
-
-CVE-2016-1000027 has been assigned to this issue in the Spring Framework. -It is regarded as a design limitation, and can be mitigated but not fixed outright. -
-
-Avoid using HttpInvokerServiceExporter, SimpleHttpInvokerServiceExporter
-and any other exporter that is based on RemoteInvocationSerializingExporter.
-Instead, use other message formats for API endpoints (for example, JSON),
-but make sure that the underlying deserialization mechanism is properly configured
-so that deserialization attacks are not possible. If the vulnerable exporters can not be replaced,
-consider using global deserialization filters introduced in JEP 290.
-
-The following example shows how a vulnerable HTTP endpoint can be defined
-using HttpInvokerServiceExporter and Spring annotations:
-
+The following example shows how a vulnerable HTTP endpoint can be defined
+using HttpInvokerServiceExporter and Spring annotations:
+
-The Spring Framework provides an abstract base class RemoteInvocationSerializingExporter
-for creating remote service exporters.
-A Spring exporter, which is based on this class, deserializes incoming data using ObjectInputStream.
-Deserializing untrusted data is easily exploitable and in many cases allows an attacker
-to execute arbitrary code.
-
-The Spring Framework also provides two classes that extend RemoteInvocationSerializingExporter:
-
HttpInvokerServiceExporter
-SimpleHttpInvokerServiceExporter
-
-These classes export specified beans as HTTP endpoints that deserialize data from an HTTP request
-using unsafe ObjectInputStream. If a remote attacker can reach such endpoints,
-it results in remote code execution in the worst case.
-
-CVE-2016-1000027 has been assigned to this issue in the Spring Framework. -It is regarded as a design limitation, and can be mitigated but not fixed outright. -
-
-Avoid using HttpInvokerServiceExporter, SimpleHttpInvokerServiceExporter
-and any other exporter that is based on RemoteInvocationSerializingExporter.
-Instead, use other message formats for API endpoints (for example, JSON),
-but make sure that the underlying deserialization mechanism is properly configured
-so that deserialization attacks are not possible. If the vulnerable exporters can not be replaced,
-consider using global deserialization filters introduced in JEP 290.
-
-The following examples shows how a vulnerable HTTP endpoint can be defined in a Spring XML config: -
-+The following examples shows how a vulnerable HTTP endpoint can be defined in a Spring XML config: +
+
+The Spring Framework provides an abstract base class RemoteInvocationSerializingExporter
+for creating remote service exporters.
+A Spring exporter, which is based on this class, deserializes incoming data using ObjectInputStream.
+Deserializing untrusted data is easily exploitable and in many cases allows an attacker
+to execute arbitrary code.
+
+The Spring Framework also provides HttpInvokerServiceExporter
+and SimpleHttpInvokerServiceExporter classes
+that extend RemoteInvocationSerializingExporter.
+
+These classes export specified beans as HTTP endpoints that deserialize data from an HTTP request
+using unsafe ObjectInputStream. If a remote attacker can reach such endpoints,
+it results in remote code execution in the worst case.
+
+CVE-2016-1000027 has been assigned to this issue in the Spring Framework. +It is regarded as a design limitation, and can be mitigated but not fixed outright. +
+
+Avoid using HttpInvokerServiceExporter, SimpleHttpInvokerServiceExporter
+and any other exporter that is based on RemoteInvocationSerializingExporter.
+Instead, use other message formats for API endpoints (for example, JSON),
+but make sure that the underlying deserialization mechanism is properly configured
+so that deserialization attacks are not possible. If the vulnerable exporters can not be replaced,
+consider using global deserialization filters introduced in JEP 290.
+