GitHub Advisoryadvisory · Maven

GHSA-f984-3wx8-grp9 XXL-RPC Deserialization of Untrusted Data vulnerability

CRITICAL Published 2024-08-05 Modified 2024-08-05 Official page ↗
Aliases
CVE-2023-45146
Ecosystem
Maven
Packages
com.xuxueli:xxl-rpc-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2024-08-05

Affected packages

• Maven com.xuxueli:xxl-rpc-core: <= 1.7.0 (no fix yet)

Description

XXL-RPC is a high performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism. When such a configuration is used, attackers may be able to connect to the server and provide malicious serialized objects that, once deserialized, force it to execute arbitrary code. This can be abused to take control of the machine the server is running by way of remote code execution. This issue has not been fixed.

Related

Alias · CVE (1)

  • CVE-2023-45146 XXL-RPC is a high performance, distributed RPC framework. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References