PT-2023-27908 · Sofarpc · Sofarpc

Bofei Chen + 2 · Published 2023-09-12 · Updated 2023-09-15 · CVE-2023-41331

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOFARPC versions prior to 5.11.0

Description SOFARPC is a Java RPC framework. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. The default configuration of the SOFARPC framework uses a blacklist to filter out dangerous classes during the deserialization process. However, the blacklist is not comprehensive, allowing an actor to exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks.

Recommendations For versions prior to 5.11.0, update to version 5.11.0 to resolve the issue. As a temporary workaround, users can add -Drpc serialize blacklist override=javax.sound.sampled.AudioFileFormat to the blacklist.

Exploit

Fix

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2023-41331

GHSA-CHV2-7HXJ-2J86

Affected Products

Sofarpc

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41331.json · Exploit
• https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-chv2-7hxj-2j86 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41331 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41331 · Security Note
• https://github.com/sofastack/sofa-rpc/releases/tag/v5.11.0 · Note
• https://twitter.com/CVEnew/status/1701691407621308566 · Twitter Post
• https://t.me/cibsecurity/70347 · Telegram Post