CVE-2023-41331

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework, a blacklist is used to filter out dangerous classes encountered during the deserialization process. However, the blacklist is not comprehensive, and an actor can exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks. Version 5.11.0 contains a fix for this issue. As a workaround, users can add `-Drpc_serialize_blacklist_override=javax.sound.sampled.AudioFileFormat` to the blacklist.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-917

Affected software

No affected versions have been published.

Timeline

Published: Sep 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-413323.5Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy h CVE-2023-413338.1Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CVE-2023-413348.4Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy c CVE-2023-413353.7Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new CVE-2023-413366.5ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit a CVE-2023-413376.7h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to mu CVE-2023-413385.3Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to CVE-2023-413395.3GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defin CVE-2023-41345.5A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due CVE-2023-413435.4Rogic No-Code Database Builder's file uploading function has insufficient filtering for special characters. A remote attacker with regular u CVE-2023-413447.5NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker CVE-2023-413458.8ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generate