critical9.8
CVE-2024-46983
SOFA Hessian Remote Command Execution (RCE) Vulnerability
Impact
### Impact SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. ### Patches Fixed this issue by update blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. ### Workarounds You can maintain a blacklist yourself in this directory `external/serialize.blacklist`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.alipay.sofa:hessian | < 3.5.5 | 3.5.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Antfin | Sofa-Hessian | before 3.5.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj
- https://github.com/advisories/GHSA-c459-2m73-67hj
- https://github.com/sofastack/sofa-hessian/commit/764ef4b216aee6aeb4b111aec8947a4e8b53bb87
- https://nvd.nist.gov/vuln/detail/CVE-2024-46983