CVE-2023-41331 SOFARPC Remote Command Execution (RCE) Vulnerability
Attackers can achieve remote code execution via JNDI injection or command execution due to an incomplete deserialization blacklist in SOFARPC.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41331?
CVE-2023-41331 is a critical unsafe deserialization vulnerability in sofastack sofa-rpc, published on 12 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework, a blacklist is used to filter out dangerous classes encountered during the deserialization process. However, the blacklist is not comprehensive, and an actor can exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks. Version 5.11.0 contains a fix for this issue. As a workaround, users can add `-Drpc_serialize_blacklist_override=javax.sound.sampled.AudioFileFormat` to the blacklist.
Weakness: CWE-917
Which versions are affected by CVE-2023-41331?
It affects 1 product.
Products include Sofastack Sofarpc.
How do I fix CVE-2023-41331?
No fix has been published for CVE-2023-41331 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-41331 being exploited?
There is no known exploitation of CVE-2023-41331 in the wild and no public exploit code.
Other vulnerabilities in sofastack sofa-rpc
Sources
Also known as GHSA-chv2-7hxj-2j86.