PT-2024-19987 · Oracle · Jdk

Yemoli · Published 2024-01-23 · Updated 2024-02-01 · CVE-2024-23636

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOFARPC versions prior to 5.12.0

Description SOFARPC is a Java RPC framework that defaults to using the SOFA Hessian protocol to deserialize received data. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. However, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components.

Recommendations For SOFARPC versions prior to 5.12.0, upgrade to version 5.12.0 to fix the issue. As a temporary workaround, users can add additional blacklists by using the -Drpc serialize blacklist override parameter, for example, -Drpc serialize blacklist override=org.apache.xpath.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-23636

GHSA-7Q8P-9953-PXVR

Affected Products

Jdk

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23636.json · Exploit
• https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76 · Patch
• https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-7q8p-9953-pxvr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23636 · Security Note
• https://osv.dev/vulnerability/GHSA-7q8p-9953-pxvr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23636 · Vendor Advisory
• https://github.com/sofastack/sofa-rpc · Note
• https://github.com/sofastack/sofa-rpc/commit/d08e25824ae9feaf0876adba9acd2938f34759b1 · Note
• https://t.me/cvenotify/69623 · Telegram Post
• https://twitter.com/CVEnew/status/1749846963812552773 · Twitter Post