Read the docs
TI-2024-15655 Aliases CVE-2024-23636GHSA-7q8p-9953-pxvr

SOFARPC Remote Command Execution(RCE) Vulnerbility

Priority MEDIUM 50CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00799 56th percentileScored 2026-11-07
Fix Fixed sofa-rpc (sofastack): 5.12.0com.alipay.sofa:rpc-sofa-boot-starter (Maven): 5.12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sofastacksofa-rpcbefore 5.12.05.12.0Patch availableCNA
—com.alipay.sofa:rpc-sofa-boot-starter (Maven)before 5.12.05.12.0Patch availableGHSA-7q8p-9953-pxvr
  • sofa-rpc Vendorsofastack Affected before 5.12.0 Fixed in 5.12.0 Patch available CNA
  • com.alipay.sofa:rpc-sofa-boot-starter (Maven) Vendor— Affected before 5.12.0 Fixed in 5.12.0 Patch available GHSA-7q8p-9953-pxvr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sofastack:sofarpc:*:*:*:*:*:*:*:*before 5.12.0Vulnerablesofastack
  • cpe:2.3:a:sofastack:sofarpc:*:*:*:*:*:*:*:* Versions before 5.12.0 Vulnerable ·sofastack

Remediation

  • Fix · CNA sofa-rpc (sofastack) Fixed in 5.12.0
  • Fix · GHSA-7q8p-9953-pxvr com.alipay.sofa:rpc-sofa-boot-starter (Maven) Fixed in 5.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23636
  2. 2026-10-03 Alias added: GHSA-7q8p-9953-pxvr

References

Patch 1

Advisory 2

Other 2

  • TI-2023-21931 SOFARPC Remote Command Execution (RCE) Vulnerability CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences