Headline
GHSA-c459-2m73-67hj: SOFA Hessian Remote Command Execution (RCE) Vulnerability
Impact
SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components.
Patches
Fixed this issue by update blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue.
Workarounds
You can maintain a blacklist yourself in this directory external/serialize.blacklist.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-46983
SOFA Hessian Remote Command Execution (RCE) Vulnerability
Package
maven com.alipay.sofa:hessian (Maven)
Affected versions
< 3.5.5
Impact
SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components.
Patches
Fixed this issue by update blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue.
Workarounds
You can maintain a blacklist yourself in this directory external/serialize.blacklist.
References
- GHSA-c459-2m73-67hj
- sofastack/sofa-hessian@764ef4b
Published to the GitHub Advisory Database
Sep 19, 2024