-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.alipay.sofa:hessian | maven | < 3.5.5 | 3.5.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from an insufficient blacklist used during deserialization. The commit diff shows significant updates to the blacklist file (serialize.blacklist), and the test file SerializerFactoryTest.java was modified to replace references to java.awt.Color with java.util.Date, indicating that the getDeserializer() method is directly involved in class validation. This method uses the blacklist to determine allowed classes, and the outdated blacklist allowed dangerous JDK classes to be deserialized, enabling RCE via gadget chains. The high confidence comes from the explicit linkage between the blacklist mechanism, the patched test cases, and the deserialization entry point in SerializerFactory.