PT-2019-19439 · Sofa · Sofahessian

Ramos-Dev · Publicado 2019-02-27 · Atualizado 2024-08-04 · CVE-2019-9212

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOFA-Hessian versions 4.0.2 and earlier

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget. The vendor does not consider this issue a vulnerability because the blacklist is being misused. SOFA Hessian supports custom blacklist and a disclaimer was posted encouraging users to update the blacklist or to use the whitelist feature for their specific needs since the blacklist is not being actively updated.

Recommendations For SOFA-Hessian versions 4.0.2 and earlier, update the blacklist or use the whitelist feature to mitigate the risk of exploitation. As a temporary workaround, consider restricting the use of the com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString classes until the issue is resolved.

Correção

Incomplete List of Disallowed Inputs

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-184

CWE-502

Identificadores relacionados

CVE-2019-9212

GHSA-PFWP-8PQ4-G7PV

Produtos afetados

Sofahessian

Referências · 7

• https://github.com/alipay/sofa-hessian/issues/34 · Correção
• https://github.com/alipay/sofa-hessian · Nota
• https://t.me/cvenotify/89066 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-9212 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-9212 · Aviso do Fabricante
• https://github.com/advisories/GHSA-pfwp-8pq4-g7pv · Nota
• https://osv.dev/vulnerability/GHSA-pfwp-8pq4-g7pv · Aviso do Fabricante