Sofastack vulnerabilities
We track 3 vulnerabilities in Sofastack products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 19, 2024.
Latest Sofastack vulnerabilities
- 9.8 Critical severity
sofa-hessian: Improper Neutralization of Special Elements in Output Used by a Downstream Component
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain tha
- 9.8 Critical severity
sofa-rpc: Deserialization of Untrusted Data
SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection.
- 9.8 Critical severity
sofa-rpc: Improper Neutralization of Special Elements used in an Expression Language Statement
SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework