sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. This issue is fixed by an update to the blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. Users unable to upgrade may maintain a blacklist themselves in the directory `external/serialize.blacklist`.
The SOFA Hessian protocol uses a blacklist mechanism to block deserialization of potentially dangerous classes. However, an attacker can exploit a gadget chain built solely from classes available in the standard JDK — without the need to use external libraries — to bypass this protection. Sending a specially crafted deserialization payload allows unauthorized actions to be triggered on the server side. The vulnerability does not require authentication or user interaction.
An attacker can gain full control over the application — it is possible to compromise confidentiality, integrity and availability of the system, including potentially remote code execution (RCE).
Update sofa-hessian to version 3.5.5, in which the blacklist has been supplemented with entries blocking the known gadget chain. Users who cannot perform the update should independently maintain their own blacklist in a file in the `external/serialize.blacklist` directory.
The sofa-hessian library (Antfin / Ant Group) — versions prior to 3.5.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAntfin Sofa Hessian
APPAntfin< 3.5.5