SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue.
SOFARPC by default uses the SOFA Hessian protocol for deserialization of received data and applies a blacklist mechanism to block deserialization of potentially dangerous classes. However, there is a gadget chain that allows bypassing this blacklist. Importantly, this chain is based solely on components built into the JDK and does not require any external libraries. An attacker can send a crafted payload that will be deserialized by the server, bypassing security measures.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on the server (RCE), which may consequently lead to complete system compromise, disclosure of sensitive data, or disruption of its operation.
SOFARPC should be updated to version 5.12.0 or newer, which extends the deserialization blacklist. As a temporary workaround, custom entries can be added to the blacklist using the JVM parameter: `-Drpc_serialize_blacklist_override=org.apache.xpath.` (or other appropriate classes) in accordance with the vendor's documentation.
SOFARPC (sofastack/sofa-rpc) versions prior to 5.12.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSofastack Sofarpc
APPSofastack< 5.12.0