PT-2019-19439 · Sofa · Sofahessian

Ramos-Dev · Published 2019-02-27 · Updated 2024-08-04 · CVE-2019-9212

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOFA-Hessian versions 4.0.2 and earlier

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget. The vendor does not consider this issue a vulnerability because the blacklist is being misused. SOFA Hessian supports custom blacklist and a disclaimer was posted encouraging users to update the blacklist or to use the whitelist feature for their specific needs since the blacklist is not being actively updated.

Recommendations For SOFA-Hessian versions 4.0.2 and earlier, update the blacklist or use the whitelist feature to mitigate the risk of exploitation. As a temporary workaround, consider restricting the use of the com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString classes until the issue is resolved.

Fix

Incomplete List of Disallowed Inputs

Deserialization of Untrusted Data

Weakness Enumeration

CWE-184

CWE-502

Related Identifiers

CVE-2019-9212

GHSA-PFWP-8PQ4-G7PV

Affected Products

Sofahessian

References · 7

• https://github.com/alipay/sofa-hessian/issues/34 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-9212 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9212 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pfwp-8pq4-g7pv · Vendor Advisory
• https://github.com/alipay/sofa-hessian · Note
• https://t.me/cvenotify/89066 · Telegram Post
• https://github.com/advisories/GHSA-pfwp-8pq4-g7pv · Note