CVE-2024-46983

sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. This issue is fixed by an update to the blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. Users unable to upgrade may maintain a blacklist themselves in the directory `external/serialize.blacklist`.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:antfin:sofa-hessian:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-09-19 23:15

Updated : 2024-09-25 17:46

NVD link : CVE-2024-46983

Mitre link : CVE-2024-46983

CVE.ORG link : CVE-2024-46983

JSON object : View

Products Affected

antfin

sofa-hessian

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

NVD-CWE-noinfo

{"id": "CVE-2024-46983", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-09-19T23:15:11.920", "references": [{"url": "https://github.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-74"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. This issue is fixed by an update to the blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. Users unable to upgrade may maintain a blacklist themselves in the directory `external/serialize.blacklist`."}, {"lang": "es", "value": "sofa-hessian es una versi\u00f3n interna mejorada de Hessian3/4 desarrollada por Ant Group CO., Ltd. El protocolo SOFA Hessian utiliza un mecanismo de lista negra para restringir la deserializaci\u00f3n de clases potencialmente peligrosas para la protecci\u00f3n de la seguridad. Pero hay una cadena de gadgets que puede eludir el mecanismo de protecci\u00f3n de lista negra de SOFA Hessian, y esta cadena de gadgets solo se basa en JDK y no depende de ning\u00fan componente de terceros. Este problema se soluciona con una actualizaci\u00f3n de la lista negra; los usuarios pueden actualizar a la versi\u00f3n 3.5.5 de sofahessian para evitar este problema. Los usuarios que no puedan actualizar pueden mantener una lista negra ellos mismos en el directorio `external/serialize.blacklist`."}], "lastModified": "2024-09-25T17:46:48.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:antfin:sofa-hessian:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40BEC4BD-1D1B-4904-9DF2-4F7E9EFD3A05", "versionEndExcluding": "3.5.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}