5 ms·
JDK9+ is important because Spring already prevents access to `class.classloader`, but it can be worked around thanks to modules (i.e. `class.module.classloader`
by bjohnson225 4y ago
JDK9+ is important because Spring already prevents access to `class.classloader`, but it can be worked around thanks to modules (i.e. `class.module.classloader` works).
- loginatnine 4y agoYes but there may be some other Gadget vulnerabilities in all those fields too. Also, you might be able to make an app OOM by setting big string values somewhere in there. It boggles my mind why this field is accessible at all and wasn't blocked in CVE-2010-1622.
- bcrosby95 4y agoYou can make an app OOM by setting big string values anywhere. You gotta handle that at a higher level and reject requests larger than a certain size, which there is already a default for.
- tru3_power 4y agoI spent a good amount of time trying to find some gadgets on jdk8 today no dice besides some DoS