Deserialization of Untrusted Data
CVE-2023-45146
Summary
XXL-RPC is a high-performance, distributed RPC framework. With it, a TCP server can be set up using the Netty framework and the Hessian serialization mechanism. When such a configuration is used, attackers may be able to connect to the server and provide malicious serialized objects that, once deserialized, force it to execute arbitrary code. This can be abused to take control of the machine the server is running by way of Remote Code Execution. This issue has not been fixed in package "com.xuxueli:xxl-rpc-core" and affects all versions. This issue also affects "com.xuxueli:xxl-job-core" versions 1.6.0 through 1.9.2, and package "com.xuxueli:xxl-mq-client" version 1.1.1.
- LOW
- NETWORK
- HIGH
- CHANGED
- NONE
- NONE
- HIGH
- HIGH
CWE-502 - Deserialization of Untrusted Data
Deserialization of untrusted data vulnerabilities enable an attacker to replace or manipulate a serialized object, replacing it with malicious data. When the object is deserialized at the victim's end the malicious data is able to compromise the victim’s system. The exploit can be devastating, its impact may range from privilege escalation, broken access control, or denial of service attacks to allowing unauthorized access to the application's internal code and logic which can compromise the entire system.
Advisory Timeline
- Published