sofastack sofa-rpc up to 5.11.x SOFA Hessian Protocol deserialization

Summaryinfo

A vulnerability was found in sofastack sofa-rpc up to 5.11.x. It has been classified as very critical. This impacts an unknown function of the component SOFA Hessian Protocol Handler. Performing a manipulation results in deserialization. This vulnerability is known as CVE-2024-23636. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as very critical has been found in sofastack sofa-rpc up to 5.11.x. This affects an unknown code block of the component SOFA Hessian Protocol Handler. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue.

The weakness was published 01/23/2024 as GHSA-7q8p-9953-pxvr. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-23636 since 01/19/2024. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/23/2024).

Upgrading to version 5.12.0 eliminates this vulnerability. Applying the patch 42d19b1b1d14a25aafd9ef7c219c04a19f90fc76 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• sofastack

Name

• sofa-rpc

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11

License

• open-source

Website

• Product: https://github.com/sofastack/sofa-rpc/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion