CVE-2026-51368: TongWeb Spring HttpInvoker RCE Vulnerability

CVE-2026-51368 Overview

CVE-2026-51368 is a remote code execution vulnerability in Beijing Tongtech Co., Ltd TongWeb v7.0.24. The flaw resides in the Spring HttpInvokerServiceExporter component exposed through the console/heimdall endpoint. A remote attacker can send a crafted request to the endpoint and execute arbitrary code on the target server. The vulnerability stems from unsafe Java deserialization of untrusted data received by the exporter. Public proof-of-concept scripts are available on GitHub Gist, increasing the practical risk to exposed installations.

Critical Impact
Unauthenticated remote attackers can execute arbitrary code on TongWeb 7.0.24 servers by sending crafted serialized payloads to the console/heimdall endpoint.

Affected Products

Beijing Tongtech Co., Ltd TongWeb v7.0.24
Deployments exposing the console/heimdall endpoint
Configurations using the Spring HttpInvokerServiceExporter component

Discovery Timeline

2026-08-25 - CVE-2026-51368 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-51368

Vulnerability Analysis

The vulnerability affects the Spring Framework HttpInvokerServiceExporter component integrated into TongWeb 7.0.24. HttpInvokerServiceExporter accepts HTTP POST requests containing Java serialized objects and deserializes them to invoke remote methods. When exposed on the console/heimdall endpoint, the exporter processes attacker-supplied serialized data without adequate type filtering. This produces a classic Java insecure deserialization condition. Spring's own documentation warns that HttpInvokerServiceExporter is unsafe when exposed to untrusted clients, because deserialization can trigger gadget chains present on the server classpath.

Root Cause

The root cause is unsafe deserialization of untrusted input in the exporter's request handler. The component uses ObjectInputStream semantics without restricting resolvable classes. Any gadget chain reachable from the TongWeb classpath, such as Commons-Collections, ROME, or Spring-based chains, can be invoked during object graph reconstruction. This maps to CWE-502 (Deserialization of Untrusted Data).

Attack Vector

Exploitation is network-based and does not require authentication when the console interface is reachable. An attacker sends an HTTP POST request to console/heimdall with a serialized Java object payload. Once the server deserializes the payload, gadget chains chain method invocations to reach Runtime.exec or an equivalent primitive. The result is arbitrary command execution under the identity of the TongWeb process. Public exploit gists demonstrate the request structure and payload delivery.

See the published proof-of-concept material for request format and payload construction: GitHub Gist PoC Script and GitHub Gist Exploit Code.

Detection Methods for CVE-2026-51368

Indicators of Compromise

HTTP POST requests to /console/heimdall with Content-Type: application/x-java-serialized-object or binary payloads beginning with the Java serialization magic bytes 0xAC 0xED 0x00 0x05.
Child processes such as sh, bash, cmd.exe, or powershell.exe spawned by the TongWeb Java process.
Outbound network connections initiated by the TongWeb JVM to unexpected hosts shortly after requests to console/heimdall.
Unexpected file writes or new JSP/WAR files under TongWeb webapp directories.

Detection Strategies

Alert on any request to console/heimdall from clients outside the administrative network segment.
Inspect request bodies for the Java serialization header 0xAC 0xED on HTTP traffic destined for TongWeb hosts.
Correlate web access logs with process telemetry showing the TongWeb JVM launching shell interpreters or scripting engines.

Monitoring Recommendations

Enable verbose access logging on TongWeb and forward logs to a centralized SIEM or data lake.
Monitor JVM process trees for anomalous child processes and unusual command lines.
Track outbound egress from application servers, flagging first-seen destinations from the TongWeb host.

How to Mitigate CVE-2026-51368

Immediate Actions Required

Restrict access to the console/heimdall endpoint at the reverse proxy or firewall to trusted administrative IP ranges only.
Take internet-exposed TongWeb 7.0.24 instances offline until a vendor patch is applied.
Rotate credentials and secrets stored on the server if exposure to untrusted networks occurred.
Contact Beijing Tongtech support for an official fixed build addressing the HttpInvokerServiceExporter exposure.

Patch Information

No vendor advisory URL is listed in the NVD entry at publication. Administrators should contact Beijing Tongtech Co., Ltd directly for a patched version of TongWeb that removes or hardens the HttpInvokerServiceExporter binding on console/heimdall. Until a fix is available, treat all TongWeb 7.0.24 deployments as vulnerable.

Workarounds

Remove or disable the HttpInvokerServiceExporter binding for console/heimdall in the TongWeb servlet configuration if operationally feasible.
Deploy a web application firewall rule that blocks POST requests to console/heimdall containing the Java serialization magic bytes 0xAC 0xED.
Enforce mutual TLS or IP allowlisting on the management console path.
Run the TongWeb process under a low-privilege service account and apply Java Security Manager or OS-level sandboxing to limit post-exploitation impact.

bash

# Example nginx snippet to restrict the vulnerable endpoint to an admin subnet
location /console/heimdall {
    allow 10.0.0.0/24;   # admin management network
    deny all;
    proxy_pass http://tongweb_backend;
}