CVE-2024-23636: Remote Command Execution in SOFARPC
(updated )
SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a block list mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian block list protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a block list. SOFARPC also provides a way to add additional block lists. Users can add a class like -Drpc_serialize_block list_override=org.apache.xpath. to avoid this issue.
References
- github.com/advisories/GHSA-7q8p-9953-pxvr
- github.com/sofastack/sofa-rpc
- github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76
- github.com/sofastack/sofa-rpc/commit/d08e25824ae9feaf0876adba9acd2938f34759b1
- github.com/sofastack/sofa-rpc/security/advisories/GHSA-7q8p-9953-pxvr
- nvd.nist.gov/vuln/detail/CVE-2024-23636
Code Behaviors & Features
Detect and mitigate CVE-2024-23636 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →