Summaryinfo

A vulnerability classified as critical was found in SOFA-Hessian up to 4.0.2. This impacts an unknown function of the component Blacklist. The manipulation as part of Hessian Object results in incomplete blacklist. This vulnerability is known as CVE-2019-9212. It is possible to launch the attack remotely. No exploit is available. It is still unclear if this vulnerability genuinely exists. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Detailsinfo

A vulnerability, which was classified as critical, was found in SOFA-Hessian up to 4.0.2. Affected is an unknown function of the component Blacklist. The manipulation as part of a Hessian Object leads to a incomplete blacklist vulnerability. CWE is classifying the issue as CWE-184. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget.

The bug was discovered 02/23/2019. The weakness was published 02/27/2019. This vulnerability is traded as CVE-2019-9212 since 02/27/2019. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1562.006 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k. The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• SOFA-Hessian

Version

• 4.0.0
• 4.0.1
• 4.0.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion