com.xuxueli:xxl-rpc-core 1.2.2 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the com.xuxueli:xxl-rpc-core package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
C Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data when the `Netty framework` and the `Hessian serialization mechanism` are used to set up a TCP server. An attacker can execute arbitrary code and potentially take control of the server machine by providing malicious serialized objects. Note: This is only exploitable if the server uses the Netty framework and the Hessian serialization mechanism. `setAllowNonSerializable()` was set to `false` by default in version 1.7.1, `HessianSerializer.java` was removed in version 1.8.0 and further hardening steps were taken in version 1.8.1 to prevent object injection. How to fix Deserialization of Untrusted Data? Upgrade `com.xuxueli:xxl-rpc-core` to version 1.8.1 or higher.	[,1.8.1)
H Command Injection Affected versions of this package are vulnerable to Command Injection due to unchecked deserialization in the `decode()` function in `NettyDecode`. An attacker can execute arbitrary code by exploiting the flawed deserialization. This is exploitable if the attacker is able to run a malicious RMI service and manipulate the serialization process. Note: `setAllowNonSerializable()` was set to `false` by default in version 1.7.1, `HessianSerializer.java` was removed in version 1.8.0 and further hardening steps were taken in version 1.8.1 to prevent object injection. How to fix Command Injection? Upgrade `com.xuxueli:xxl-rpc-core` to version 1.8.1 or higher.	[,1.8.1)

Vulnerability

Vulnerable Version

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data when the Netty framework and the Hessian serialization mechanism are used to set up a TCP server. An attacker can execute arbitrary code and potentially take control of the server machine by providing malicious serialized objects.

Note:

This is only exploitable if the server uses the Netty framework and the Hessian serialization mechanism.

setAllowNonSerializable() was set to false by default in version 1.7.1, HessianSerializer.java was removed in version 1.8.0 and further hardening steps were taken in version 1.8.1 to prevent object injection.

How to fix Deserialization of Untrusted Data?

Upgrade com.xuxueli:xxl-rpc-core to version 1.8.1 or higher.

[,1.8.1)

Command Injection

Affected versions of this package are vulnerable to Command Injection due to unchecked deserialization in the decode() function in NettyDecode. An attacker can execute arbitrary code by exploiting the flawed deserialization. This is exploitable if the attacker is able to run a malicious RMI service and manipulate the serialization process.

Note: setAllowNonSerializable() was set to false by default in version 1.7.1, HessianSerializer.java was removed in version 1.8.0 and further hardening steps were taken in version 1.8.1 to prevent object injection.

How to fix Command Injection?

Upgrade com.xuxueli:xxl-rpc-core to version 1.8.1 or higher.

[,1.8.1)

com.xuxueli:xxl-rpc-core@1.2.2 vulnerabilities

latest version

first published

latest version published

licenses detected

package manager

Direct Vulnerabilities

How to fix?