CVE-2019-9212 Incomplete List of Disallowed Inputs in SOFA-Hessian

What is CVE-2019-9212?

CVE-2019-9212 is a critical unsafe deserialization vulnerability in n/a, published on 27 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget. NOTE: The vendor doesn’t consider this issue a vulnerability because the blacklist is being misused. SOFA Hessian supports custom blacklist and a disclaimer was posted encouraging users to update the blacklist or to use the whitelist feature for their specific needs since the blacklist is not being actively updated

Weakness: CWE-502, CWE-184

Which versions are affected by CVE-2019-9212?

4 open source packages ship an affected version, including com.alipay.sofa:hessian. It affects 1 product.

Products include Antfin Sofa-Hessian.

How do I fix CVE-2019-9212?

Upgrade com.alipay.sofa:hessian to a fixed version for your release line: 3.3.6 or 4.0.2.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2019-9212 being exploited?

There is no known exploitation of CVE-2019-9212 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pfwp-8pq4-g7pv.