CVE-2024-46983: SOFA Hessian Remote Command Execution (RCE) Vulnerability

September 19, 2024 (updated September 20, 2024)

SOFA Hessian protocol uses a denylist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian denylist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components.

References

github.com/advisories/GHSA-c459-2m73-67hj
github.com/sofastack/sofa-hessian
github.com/sofastack/sofa-hessian/commit/764ef4b216aee6aeb4b111aec8947a4e8b53bb87
github.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj
nvd.nist.gov/vuln/detail/CVE-2024-46983

Code Behaviors & Features

Detect and mitigate CVE-2024-46983 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →