CVE-2024-46983
📋 TL;DR
CVE-2024-46983 is a critical deserialization vulnerability in SOFA Hessian that allows attackers to bypass blacklist protections and execute arbitrary code using only JDK classes. This affects all systems using vulnerable versions of sofa-hessian for Java object serialization/deserialization. The vulnerability enables remote code execution without requiring third-party dependencies.
💻 Affected Systems
- sofa-hessian
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, or lateral movement across the network.
Likely Case
Remote code execution allowing attackers to gain shell access, install backdoors, or exfiltrate sensitive data from affected systems.
If Mitigated
Limited impact with proper network segmentation, minimal privileges, and monitoring in place, though exploitation risk remains.
🎯 Exploit Status
The advisory confirms a working gadget chain exists using only JDK classes, making exploitation straightforward for attackers with access to deserialization endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.5
Vendor Advisory: https://github.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj
Restart Required: Yes
Instructions:
1. Update pom.xml or build.gradle to use sofa-hessian version 3.5.5 or higher. 2. Rebuild and redeploy the application. 3. Restart all services using the updated library.
🔧 Temporary Workarounds
Manual blacklist maintenance
allMaintain a custom blacklist file to block dangerous classes if upgrading is not immediately possible
Create or update external/serialize.blacklist with additional class restrictions
🧯 If You Can't Patch
- Implement strict network controls to limit access to deserialization endpoints
- Deploy runtime application self-protection (RASP) or WAF with deserialization attack detection
🔍 How to Verify
Check if Vulnerable:
Check dependency manifest for sofa-hessian version below 3.5.5Check Version:
mvn dependency:tree | grep sofa-hessian OR gradle dependencies | grep sofa-hessianVerify Fix Applied:
Confirm sofa-hessian version 3.5.5 or higher is present in dependencies📡 Detection & Monitoring
Log Indicators:
- Unusual Java class loading patterns
- Deserialization errors or exceptions
- Unexpected process spawning
Network Indicators:
- Unusual outbound connections from application servers
- Traffic to known malicious IPs
SIEM Query:
source="application.logs" AND ("deserialization" OR "Hessian" OR "ClassNotFoundException")