CVE-2023-41331

Critical

Description

SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework, a blacklist is used to filter out dangerous classes encountered during the deserialization process. However, the blacklist is not comprehensive, and an actor can exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks. Version 5.11.0 contains a fix for this issue. As a workaround, users can add `-Drpc_serialize_blacklist_override=javax.sound.sampled.AudioFileFormat` to the blacklist.

SeverityCritical

CVSS9.8

Exploit probability—

ProductSofastack Sofarpc

PublishedSep 12, 2023

First seenSep 12, 2023

Weakness typeCWE-917Expression language injection

How to fix

Update

sofastack sofarpc5.11.0 or later

Affected products

Product	Affected versions	Fixed in
sofastack sofarpc	v < 5.11.0	5.11.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.