CVE-2024-23636: Sofastack SOFARPC RCE Vulnerability

CVE-2024-23636 Overview

CVE-2024-23636 is an insecure deserialization vulnerability in SOFARPC, a Java RPC framework developed by Ant Group. The framework defaults to using the SOFA Hessian protocol for deserializing received data, which implements a blacklist mechanism to prevent deserialization of potentially dangerous classes. However, a gadget chain was discovered that can bypass this blacklist protection mechanism, relying solely on JDK classes without requiring any third-party components, enabling remote code execution.

Critical Impact
Attackers can achieve remote code execution by exploiting the deserialization blacklist bypass, potentially gaining full control over affected systems running SOFARPC versions prior to 5.12.0.

Affected Products

Sofastack SOFARPC versions prior to 5.12.0
Applications using SOFA Hessian protocol for RPC communication
Java-based microservices utilizing SOFARPC for inter-service communication

Discovery Timeline

2024-01-23 - CVE-2024-23636 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-23636

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The SOFA Hessian protocol implements security controls through a blacklist mechanism designed to block the deserialization of known dangerous classes. However, researchers identified a gadget chain composed entirely of JDK classes that was not covered by the existing blacklist, allowing attackers to craft malicious serialized objects that bypass these protections.

The attack can be executed remotely without authentication, requires no user interaction, and can result in complete compromise of confidentiality, integrity, and availability of the target system. The vulnerability is particularly concerning because it leverages only standard JDK classes, meaning any application running SOFARPC with the default Hessian protocol configuration is potentially vulnerable regardless of its third-party dependencies.

Root Cause

The root cause lies in an incomplete blacklist within the SOFA Hessian deserialization implementation. The security mechanism failed to account for certain JDK classes that could be chained together to achieve code execution. Specifically, classes like java.lang.Class and java.lang.Runtime were not included in the original blacklist, providing attackers with the building blocks necessary to construct a working exploit chain.

Attack Vector

The attack is network-based and targets SOFARPC services that accept serialized data via the SOFA Hessian protocol. An attacker can send a crafted serialized payload containing a gadget chain that bypasses the blacklist. When the server deserializes this payload, the gadget chain executes, allowing arbitrary code execution on the target system. The attack requires no prior authentication or special privileges, making it highly exploitable in exposed environments.

text

# Security patch adding classes to serialize_blacklist.txt
# Source: https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76

 java.io.Closeable
 java.io.Serializable
 java.lang.AutoCloseable
-java.lang.Class
 java.lang.Cloneable
 java.lang.Iterable
 java.lang.ProcessBuilder
 java.lang.Readable
 java.lang.Runnable
-java.lang.Runtime
 java.lang.Thread
 java.lang.UNIXProcess
 java.net.InetAddress

The patch above shows that java.lang.Class and java.lang.Runtime were removed from the whitelist (indicated by the - prefix), effectively adding them to the blocked classes. These classes were critical components in the gadget chain that enabled the bypass.

Detection Methods for CVE-2024-23636

Indicators of Compromise

Unusual serialized payloads containing references to java.lang.Class or java.lang.Runtime in RPC traffic
Unexpected process spawning from Java application processes running SOFARPC
Anomalous outbound network connections initiated by SOFARPC service processes
Error logs indicating deserialization failures with suspicious class names

Detection Strategies

Monitor network traffic for Hessian-serialized payloads containing known gadget chain class signatures
Implement application-level logging for deserialization events and analyze for anomalous class instantiation patterns
Deploy runtime application self-protection (RASP) solutions to detect and block deserialization attacks
Use intrusion detection systems with signatures for Java deserialization exploitation attempts

Monitoring Recommendations

Enable verbose logging for SOFARPC services to capture deserialization activity
Set up alerts for process creation events originating from Java RPC service processes
Monitor for unusual network connections from services that should not initiate outbound traffic
Implement file integrity monitoring on SOFARPC configuration and blacklist files

How to Mitigate CVE-2024-23636

Immediate Actions Required

Upgrade SOFARPC to version 5.12.0 or later immediately
If immediate upgrade is not possible, apply the custom blacklist workaround using JVM arguments
Audit network exposure of SOFARPC services and restrict access where possible
Review application logs for signs of exploitation attempts

Patch Information

The vulnerability was fixed in SOFARPC version 5.12.0. The fix involves updating the serialization blacklist to include additional dangerous classes. The security patch commit (42d19b1b1d14a25aafd9ef7c219c04a19f90fc76) adds java.lang.Class and java.lang.Runtime to the blocked classes list, preventing the identified gadget chain from executing. For detailed patch information, see the GitHub Security Advisory GHSA-7q8p-9953-pxvr.

Workarounds

Add the JVM argument -Drpc_serialize_blacklist_override=org.apache.xpath. to extend the blacklist
Consider implementing additional serialization filters at the application level
Restrict network access to SOFARPC endpoints using firewalls or network segmentation
Deploy Web Application Firewall (WAF) rules to filter malicious serialized payloads

bash

# Configuration example - Add custom blacklist override
java -Drpc_serialize_blacklist_override=org.apache.xpath. -jar your-application.jar

# Alternative: Add to application startup script
export JAVA_OPTS="$JAVA_OPTS -Drpc_serialize_blacklist_override=org.apache.xpath."