Open Internet by MindsNet

Abuse of HTTP HEAD Request Body Processing

The processing of request bodies in HTTP HEAD requests leads to potential security vulnerabilities, such as unauthenticated Java deserialization RCE. This occurs when applications consume request bodies regardless of the HTTP method and pass the stream into ObjectInputStream.readObject() without filtering.

Computing & Technology, Computer Science, Programming Languages