CVE-2024-23636

SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76	Patch
https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-7q8p-9953-pxvr	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sofastack:sofarpc:*:*:*:*:*:*:*:*

History

23 Jan 2024, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-23 18:15

Updated : 2024-02-01 20:17

NVD link : CVE-2024-23636

Mitre link : CVE-2024-23636

CVE.ORG link : CVE-2024-23636

JSON object : View

Products Affected

sofastack

sofarpc

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2024-23636", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-01-23T18:15:19.433", "references": [{"url": "https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-7q8p-9953-pxvr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue."}, {"lang": "es", "value": "SOFARPC es un framework Java RPC. SOFARPC utiliza de forma predeterminada el protocolo SOFA Hessian para deserializar los datos recibidos, mientras que el protocolo SOFA Hessian utiliza un mecanismo de lista negra para restringir la deserializaci\u00f3n de clases potencialmente peligrosas para la protecci\u00f3n de la seguridad. Pero, antes de la versi\u00f3n 5.12.0, exist\u00eda una cadena de dispositivos que pod\u00eda eludir el mecanismo de protecci\u00f3n de la lista negra de SOFA Hessian, y esta cadena de dispositivos solo se basa en JDK y no depende de ning\u00fan componente de terceros. La versi\u00f3n 5.12.0 solucion\u00f3 este problema agregando una lista negra. SOFARPC tambi\u00e9n proporciona una forma de agregar listas negras adicionales. Los usuarios pueden agregar una clase como `-Drpc_serialize_blacklist_override=org.apache.xpath.` para evitar este problema."}], "lastModified": "2024-02-01T20:17:34.393", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sofastack:sofarpc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B157065-0631-4FFB-8A18-D8BA348F3166", "versionEndExcluding": "5.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}