CVE-2024-46983
Description
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. This issue is fixed by an update to the blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. Users unable to upgrade may maintain a blacklist themselves in the directory `external/serialize.blacklist`.
How to fix
- antfin sofa-hessian3.5.5 or later
- com.alipay.sofa:hessian3.5.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| antfin sofa-hessian | v < 3.5.5 | 3.5.5 |
| com.alipay.sofa:hessianMaven | v < 3.5.5 | 3.5.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.