3 ms·
Yea it didn't help that this was posted a bit after https://spring.io/blog/2022/03/29/cve-report-published-for-spring-cloud-function https://spring.io/blog/2022
by loginatnine 5y ago
Yea it didn't help that this was posted a bit after https://spring.io/blog/2022/03/29/cve-report-published-for-spring-cloud-function https://spring.io/blog/2022/03/29/cve-report-published-for-s... and that the original article mentioned a commit on the class `SerializationUtils` which in the end has no connection to this.
I believe accessing the `class` object here is a mistake. You can see my analysis here where I trace the POC https://news.ycombinator.com/item?id=30862953 https://news.ycombinator.com/item?id=30862953 but like you said, there are other problematic code paths for sure with this.