-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the literpc HTTP endpoint, which allows client-side selection of the serialization mechanism via the LiteRpc-Serializer HTTP header. The core of the issue is twofold. First, the HttpServletRpcEndpoint.doFilter method blindly trusts this header to select a serializer. Second, one of the available serializers, JdkRpcSerializer, uses Java's native ObjectInputStream.readObject method, which is known to be unsafe when used on untrusted data. An attacker can exploit this by sending a request with LiteRpc-Serializer: jdk and a malicious serialized Java object in the request body. The doFilter method will route this input to the JdkRpcSerializer.read method, which will then deserialize the payload, leading to remote code execution. Both functions would appear in a stack trace during exploitation, with doFilter being the entry point and read being the function that directly triggers the vulnerable operation.
org.nutz.boot.starter.literpc.impl.endpoint.http.HttpServletRpcEndpoint.doFilternutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java
org.nutz.boot.starter.literpc.impl.serializer.JdkRpcSerializer.readnutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/serializer/JdkRpcSerializer.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.nutz:nutzboot-parent | maven | <= 2.6.0-SNAPSHOT |
JavaJavaOngoing coverage of React2Shell