CVE-2023-41331
📋 TL;DR
SOFARPC versions before 5.11.0 are vulnerable to remote command execution through deserialization attacks. Attackers can bypass the incomplete blacklist filter to execute arbitrary system commands or achieve JNDI injection via crafted payloads. This affects all systems running vulnerable SOFARPC instances, particularly those exposed to untrusted networks.
💻 Affected Systems
- SOFARPC
📦 What is this software?
Sofarpc by Sofastack
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, install malware, exfiltrate data, or pivot to other systems.
Likely Case
Remote code execution leading to data theft, service disruption, or lateral movement within the network.
If Mitigated
Limited impact through network segmentation and proper access controls, but still potentially exploitable.
🎯 Exploit Status
Exploitation requires crafting specific deserialization gadget chains using JDK classes and third-party packages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.11.0
Vendor Advisory: https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-chv2-7hxj-2j86
Restart Required: Yes
Instructions:
1. Download SOFARPC version 5.11.0 or later from official repository. 2. Replace vulnerable JAR files with patched versions. 3. Restart all SOFARPC services and dependent applications.
🔧 Temporary Workarounds
Blacklist Enhancement
allAdd additional classes to the deserialization blacklist to block known exploitation vectors.
-Drpc_serialize_blacklist_override=javax.sound.sampled.AudioFileFormat
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SOFARPC instances from untrusted networks
- Deploy web application firewall (WAF) rules to detect and block suspicious deserialization patterns
🔍 How to Verify
Check if Vulnerable:
Check SOFARPC version in application dependencies or JAR manifest. Versions below 5.11.0 are vulnerable.Check Version:
Check Maven/Gradle dependencies or examine JAR file: java -jar sofa-rpc-core-*.jar --versionVerify Fix Applied:
Confirm SOFARPC version is 5.11.0 or higher and verify the blacklist configuration includes recommended additions.📡 Detection & Monitoring
Log Indicators:
- Unusual deserialization errors
- JNDI lookup attempts
- Unexpected process executions from SOFARPC
Network Indicators:
- Suspicious RPC payloads with serialized objects
- Outbound connections to unusual ports from SOFARPC processes
SIEM Query:
source="sofa-rpc" AND (event_type="deserialization_error" OR process_execution="cmd.exe" OR process_execution="/bin/sh")