Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
dubbo/hessian-lite
master @ 6878285
4
Fixes
0
CVEs
CRITICAL
Peak severity
Highlights
Deserialization of Untrusted Data: 3 prior fixes. Scrutinize any change in this area.
src/main/java/com/alibaba/com/caucho/hessian/io/SerializerFactory.java: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Deserialization of Untrusted Data: Attackers can instantiate dangerous arbitrary gadgets during deserialization. Relying on unsafe legacy serializers like BeanSerializer allows unvalidated class loading through reflection. Strict class-filtering and removing known bad serializers are required.
Deserialization of Untrusted Data: Insufficient validation of incoming class names when resolving classes via factory lookups allows arbitrary class loading. Mitigating this requires a strict class factory allowlist during Class.forName resolution.
Insecure Deserialization: Allowing non-serializable classes to bypass checks during deserialization opens up vectors for instantiating arbitrary non-serializable gadgets. Enforcing Serializable checks on the deserialization side is critical to maintaining type safety.