[🐸 Frogbot] Update version of org.springframework:spring-web to 6.0.0 - #9

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Direct Dependencies	Impacted Dependency	Fixed Versions
Critical	CVE-2016-1000027	Not Applicable	org.springframework:spring-web:5.3.39	org.springframework:spring-web 5.3.39	[6.0.0]

🔖 Details

Vulnerability Details

Jfrog Research Severity:	Critical
Contextual Analysis:	Not Applicable
Direct Dependencies:	org.springframework:spring-web:5.3.39
Impacted Dependency:	org.springframework:spring-web:5.3.39
Fixed Versions:	[6.0.0]
CVSS V3:	9.8

Unsafe deserialization in Spring RemoteInvocationSerializingExporter could lead to remote code execution.

🔬 JFrog Research Details

Description:
Spring-based applications that export service beans as endpoints using classes that extend the RemoteInvocationSerializingExporter class are vulnerable to Java deserialization attacks which could lead to RCE (Remote Code Execution). As of 2016, this vulnerability is still not fixed, as the Pivotal team (the maintainers of the Spring framework) disputed it as a security vulnerability in Spring itself and decided not to issue a fix. Instead, they deprecated HttpInvokerServiceExporter and SimpleHttpInvokerServiceExporter, the potentially vulnerable exporter classes that extend RemoteInvocationSerializingExporter and warned application developers not to use them when exposed to untrusted user input (see "WARNING" in the documentation). Applications that do not use the above classes can safely ignore this vulnerability.

Remediation:

Deployment mitigations

Do not use Java serialization for external endpoints (Do not extend the RemoteInvocationSerializingExporter class)