CVE-2024-23636

SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue.

• CWE-502

• https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76Patch
• https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-7q8p-9953-pxvrVendor Advisory
• https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76Patch
• https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-7q8p-9953-pxvrVendor Advisory

Published

Jan 23, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23629An authentication bypass vulnerability exists in the web com…7.5
• CVE-2024-2363** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in…5.3
• CVE-2024-23630An arbitrary firmware upload vulnerability exists in the Mot…8.8
• CVE-2024-23633Label Studio, an open source data labeling tool had a remote…6.1
• CVE-2024-23634GeoServer is an open source software server written in Java …6
• CVE-2024-23635AntiSamy is a library for performing fast, configurable clea…6.1
• CVE-2024-23637OctoPrint is a web interface for 3D printer.s OctoPrint vers…4.9
• CVE-2024-23638Squid is a caching proxy for the Web. Due to an expired poin…6.5
• CVE-2024-23639Micronaut Framework is a modern, JVM-based, full stack Java …7.8
• CVE-2024-2364A vulnerability classified as problematic has been found in …4.6
• CVE-2024-23640GeoServer is an open source software server written in Java …4.8
• CVE-2024-23641SvelteKit is a web development kit. In SvelteKit 2, sending …7.5