CVE-2024-46983

Remote Command Execution(RCE) Vulnerbility in sofa-hessian

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

EIP currently links 1 curated repository PoC to CVE-2024-46983.

Description

sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. This issue is fixed by an update to the blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. Users unable to upgrade may maintain a blacklist themselves in the directory `external/serialize.blacklist`.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 20, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

sofa-hessian

Browse antfin / sofa-hessian

Default status: unknown

CVE ListBefore 3.5.5affected

sofa-hessian

Browse sofastack / sofa-hessian
CVE List< 3.5.5affected

com.alipay.sofa:hessian

Browse Maven / com.alipay.sofa:hessian
GitHub AdvisoryBefore 3.5.5 · Fixed in 3.5.5affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2025-26866Curated repository PoCby exploitintel8Exploit12 files

C · 108.5 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python 3 exploit for CVE-2025-26866, an insecure Hessian2 deserialization vulnerability in Apache HugeGraph PD. It sends a crafted SOFABolt V1 RPC request containing a ProxyLazyValue gadget chain to achieve unauthenticated Remote Code Execution by creating a marker file on the target.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation and a Python PoC script for CVE-2025-26866. The PoC exploits a deserialization vulnerability in Apache HugeGraph PD to create a marker file on a target container, demonstrating Remote Code Execution. The script's behavior is fully disclosed in the accompanying documentation and its own source code. It connects to a specified target, sends a crafted SOFABolt payload containing a Java gadget chain, and verifies the exploit by checking for a marker file via Docker exec. No concealed, deceptive, or operator-directed harmful behavior (such as credential theft, unrelated remote access, persistence, or an unrelated payload) was observed. The artifact performs only the advertised vulnerability demonstration.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareApache HugeGraph PD
Attack typesDeserialization of Untrusted DataRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is poc/poc.py, which is explicitly designed to exploit CVE-2025-26866 by sending a malicious deserialization payload to achieve Remote Code Execution. The code constructs a gadget chain, sends it over the network, and verifies the resulting code execution by checking for a created file. This is the definition of an exploit.

poc/poc.py:1-51poc/poc.py:512-598poc/poc.py:601-625

Requirements

  • Network access to the target's SOFABolt Raft RPC service on port 8610.poc/poc.py:21-23
  • Target must be running a vulnerable version of Apache HugeGraph PD (1.0.0 – 1.5.0) with sofa-hessian 3.3.6.poc/poc.py:7
  • Python 3 with standard library only (no external dependencies).poc/poc.py:46

Observed behavior

  • Sends a SOFABolt V1 heartbeat to verify target connectivity.poc/poc.py:495-509
  • Constructs a custom sofa-hessian 3.3.6 payload containing a ProxyLazyValue gadget chain (TreeMap -> RdnEntry.compareTo -> UIDefaults.get -> ProxyLazyValue.createValue -> FileOutputStream).poc/poc.py:229-328
  • Wraps the payload in a SOFABolt V1 RPC request frame with className 'org.apache.hugegraph.pd.raft.RaftRpcProcessor$GetMemberRequest' and sends it to the target.poc/poc.py:340-371poc/poc.py:536-544
  • Verifies Remote Code Execution by checking for the creation of a marker file (/tmp/hugegraph_rce_proof) on the target container via 'docker exec'.poc/poc.py:601-625
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe PoC connects to a user-supplied target to deliver the exploit payload. This is the expected behavior for a vulnerability PoC.poc/poc.py:460-488
File Creation
Payload withheldThe PoC creates a marker file on the target to prove RCE. This is the advertised purpose of the exploit and is verified via Docker exec.poc/poc.py:229-252poc/poc.py:601-625
Command Execution
Payload withheldThe PoC uses subprocess to run 'docker exec' for verifying the marker file. This is a local verification step, not a payload on the target.poc/poc.py:605-606
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files in the artifact were included. The analysis is based on the four provided text files (CVE-LAB.md, README.md, poc/poc.py, poc_verification_report.md).
  • The evidence includes a non-text media file (14582 bytes) and unclassified files (42051 bytes) that were not analyzed, which may contain additional context.
  • Binary files and non-text media were flagged as metadata-only and not analyzed; however, the inventory reports zero binary files and the evidence consists entirely of readable text.
  • The review is limited to the supplied text evidence and does not assess the safety of executing the PoC in a given environment.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4