mirror of
https://github.com/spring-projects/spring-boot.git
synced 2026-09-17 12:09:16 +00:00
Andy Wilkinson
001171f8eb
While remote code execution is a feature of remote DevTools, hardening of the deserialization of ClassLoaderFiles is not without benefit. Not least, it should prevent false-positive reports from AI-based security scanners that look at the code in isolation without understanding the full context of the feature. It should be noted that this hardening in no way protects against remote code execution and the use of remote DevTools remains an opt-in feature that should only be enabled in a trusted setting and secured with a sufficiently complex secret. It remains the case that an attacker who compromises the secret and has network access to the remote application can achieve RCE by uploading a serialized ClassLoaderFiles payload that adds malicious code and/or resources to the application. Closes gh-50272