GitHub Advisoryadvisory · Maven

GHSA-c459-2m73-67hj SOFA Hessian Remote Command Execution (RCE) Vulnerability

HIGH Published 2024-09-19 Modified 2024-09-20 Official page ↗
Aliases
CVE-2024-46983
Ecosystem
Maven
Packages
com.alipay.sofa:hessian
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502, CWE-74
Reviewed
2024-09-19

Affected packages

• Maven com.alipay.sofa:hessian: < 3.5.5 → fixed in 3.5.5

Description

Impact SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Patches Fixed this issue by update blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. Workarounds You can maintain a blacklist yourself in this directory `external/serialize.blacklist`.

Related

Alias · CVE (1)

  • CVE-2024-46983 sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. vulnerability

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References