Vulnerability · Published Sep 12, 2023 · Assigned by GitHub_M
CVE-2023-41331SOFARPC Remote Command Execution (RCE) Vulnerability
Critical 9.8
In plain English
A critical-severity expression language injection in sofa-rpc from sofastack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Official description
SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework, a blacklist is used to filter out dangerous classes encountered during the deserialization process. However, the blacklist is not comprehensive, and an actor can exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks. Version 5.11.0 contains a fix for this issue. As a workaround, users can add `-Drpc_serialize_blacklist_override=javax.sound.sampled.AudioFileFormat` to the blacklist.
Affected products (as reported)
Weakness: CWE-917 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-chv2-7hxj-2j86 x_refsource_CONFIRM
- https://github.com/sofastack/sofa-rpc/releases/tag/v5.11.0 x_refsource_MISC