Possible Spring core RCE
(Author of the OG Log4Shell post here)<p>I&#x27;m poking around at the Spring code and posting some notes about what I find on Twitter[0].<p>I&#x27;m not a Java expert so if anybody feels like chiming in to help connect the dots for others, please feel free. It&#x27;s late over here so I&#x27;m just doing my best to help determine if this is a real problem or just fear mongering.<p>0: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;LunaSecIO&#x2F;status&#x2F;1509084844042510336" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;LunaSecIO&#x2F;status&#x2F;1509084844042510336</a><p>EDIT:<p>I wrote a basic vulnerable app on GitHub[1] that is helpful for finding the most &quot;simple&quot; payload that could trigger this RCE. If anybody with better Java skills than myself would be willing to poke at this for a sec, that&#x27;d be super appreciated.<p>I was using this guide[2] with the ysoserial section to generate a deserialzation payload for this. I still don&#x27;t have enough Java-fu to understand how to get that to fire though, and it&#x27;s 3am so my brain is shot. Perhaps with these pointers somebody else can figure out that part to help sort out the impact around this possible RCE.<p>1: <a href="https:&#x2F;&#x2F;github.com&#x2F;lunasec-io&#x2F;spring-rce-vulnerable-app" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;lunasec-io&#x2F;spring-rce-vulnerable-app</a><p>2: <a href="https:&#x2F;&#x2F;foxglovesecurity.com&#x2F;2015&#x2F;11&#x2F;06&#x2F;what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability&#x2F;" rel="nofollow">https:&#x2F;&#x2F;foxglovesecurity.com&#x2F;2015&#x2F;11&#x2F;06&#x2F;what-do-weblogic-web...</a>