| शीर्षक | alldatacenter alldata v0.6.8 CWE-502 |
|---|
| विवरण | The service-data-dts service ships an xxl-rpc Netty listener (default TCP port 7080) whose default serializer is Hessian2. The listener deserializes raw, attacker-controlled TCP bytes through Hessian2Input.readObject() with no type filtering, and no authentication is enforced before deserialization. A network attacker who can reach port 7080 can send a crafted serialized object to achieve remote code execution, running as the service account. The HTTP application layer separately marks every request permitAll() and disables CSRF (WebSecurityConfiguration), but this finding concerns the RPC listener, which is exposed independently of the web security config. |
|---|
| स्रोत | ⚠️ https://github.com/alldatacenter/alldata/issues/832 |
|---|
| उपयोगकर्ता | fakebug (UID 94486) |
|---|
| सबमिशन | 26/06/2026 04:16 AM (2 महीनों पहले) |
|---|
| संयम | 14/08/2026 07:50 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 389959 [alldatacenter alldata तक 0.6.8 xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|