Hacker News Reader

The blog post on Kendra looks like a draft hoping for an actual confirmation/poc to come up, the mitigation just explains manually how to replicate the PR #28075.

Edit: They just translated the chinese post you can find linked here.

[1] https://github.com/spring-projects/spring-framework/pull/280...

View on HN

A comment [0] on the commit of that PR points to this site [1]. This site mentions that the vulnerability is similar to CVE-2010-1622 [2, 3]. Maybe this could help finding the issue, toegether with the recommended actions and mentioned classes (CachedIntrospectionResults, CacheResultInterceptor).

[0]: https://github.com/spring-projects/spring-framework/commit/7...

[1]: https://mp.weixin.qq.com/s/P-NEJzUUjIyemkSe_RbicQ

[2]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1622

[3]: https://www.exploit-db.com/exploits/13918

Reply on news.ycombinator.com