VMware Spring Framework Data Binding ClassLoader

This strike exploits a remote code execution vulnerability in Spring Cloud Foundation. The vulnerability is due to inadequate validation of parameters used for data binding, allowing for manipulation of the ClassLoader. A remote attacker could exploit this vulnerability by providing a crafted parameter in an HTTP request. Successful exploitation could lead to ClassLoader manipulation, which may lead to execution of arbitrary code under the security context of the container of the target application. *NOTE: In one-arm, the strike will attempt to create a webshell at webapps/ROOT/shell.jsp which can be used for Remote Code Execution.