CVE-2023-41331: SOFARPC Remote Command Execution (RCE) Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-12 · updated 2026-06-17
Weakness: CWE-917

Description

SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework, a blacklist is used to filter out dangerous classes encountered during the deserialization process. However, the blacklist is not comprehensive, and an actor can exploit certain native JDK classes and common third-party packages to construct gadget chains capable of achieving JNDI injection or system command execution attacks. Version 5.11.0 contains a fix for this issue. As a workaround, users can add `-Drpc_serialize_blacklist_override=javax.sound.sampled.AudioFileFormat` to the blacklist.

Affected products

sofastack Sofarpc: before 5.11.0 — fixed in 5.11.0

How to fix

Upgrade to a fixed version: sofastack Sofarpc 5.11.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-41331 or the next vulnerability affects your stack