GHSA-c459-2m73-67hj
SOFA Hessian Remote Command Execution (RCE) Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.alipay.sofa:hessian | < 3.5.5 | 3.5.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components.
### Patches
Fixed this issue by update blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue.
### Workarounds
You can maintain a blacklist yourself in this directory `external/serialize.blacklist`.
References
External links from the advisory. They lead to third-party sites.