PT-2024-25419 · Xuxueli · Xuxueli Xxl-Job

Qqwp220 · Published 2024-04-06 · Updated 2025-07-18 · CVE-2024-3366

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xuxueli xxl-job versions 2.4.0 through 2.4.1

Description A vulnerability was found in the deserialize function of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. This issue leads to injection. The exploit has been disclosed to the public and may be used.

Recommendations For versions 2.4.0 through 2.4.1, as a temporary workaround, consider disabling the deserialize function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-74

CWE-502

Related Identifiers

CVE-2024-3366

GHSA-2V42-XP3J-47M4

Affected Products

Xuxueli Xxl-Job

References · 15

• 🔥 https://github.com/xuxueli/xxl-job/issues/3391 · Exploit
• https://osv.dev/vulnerability/CVE-2024-3366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3366 · Security Note
• https://osv.dev/vulnerability/GHSA-2v42-xp3j-47m4 · Vendor Advisory
• https://github.com/xuxueli/xxl-job · Note
• https://github.com/xuxueli/xxl-job/commit/e3b2e1234614195390f46e26c15cd4881bd4dbe3 · Note
• https://github.com/xuxueli/xxl-job/blob/761de38a0b2a39706e2008e7914fba13bf4ca184/xxl-job-core/src/main/java/com/xxl/job/core/util/JdkSerializeTool.java#L4 · Note
• https://t.me/cvenotify/129490 · Telegram Post
• https://vuldb.com/?id.259480 · Note
• https://twitter.com/CVEnew/status/1776560767795692013 · Twitter Post
• https://t.me/cvenotify/75907 · Telegram Post
• https://vuldb.com/?submit.308180 · Note
• https://vuldb.com/?ctiid.259480 · Note
• https://t.me/cvenotify/121222 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1776587377453973965 · Twitter Post