Skip to content
OpenAdvisories

Vendor

sofastack

3 known vulnerabilities.

Products

sofa-rpc 2 sofa-hessian 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-46983

    Remote Command Execution(RCE) Vulnerbility in sofa-hessian

    sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain th…

    sofastack sofa-hessian com.alipay.sofa:hessian Maven
  • Critical 9.8
    CVE-2024-23636

    SOFARPC Remote Command Execution(RCE) Vulnerbility

    SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection.…

    sofastack sofa-rpc com.alipay.sofa:rpc-sofa-boot-starter Maven
  • Critical 9.8
    CVE-2023-41331

    SOFARPC Remote Command Execution (RCE) Vulnerability

    SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framewor…

    sofastack sofa-rpc