An example of a vulnerable HTTP endpoint based on HttpInvokerServiceExporter (CVE-2016-1000027)

beans.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
	http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

    <bean id="accountService" class="com.gypsyengineer.server.AccountServiceImpl"/>

    <bean name="/account" class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
        <property name="service" ref="accountService"/>
        <property name="serviceInterface" value="com.gypsyengineer.api.AccountService"/>
    </bean>
</beans>