Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

weibocom/motan

              master @ 4c18b71
            

Fixes

CVEs

CRITICAL

Peak severity

25.0%

Coverage

Highlights

Deserialization of Untrusted Data: 2 prior fixes. Scrutinize any change in this area.

motan-core: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: Unsafe Java ObjectInputStream deserialization of Throwable payloads allows remote attackers to execute arbitrary code. Manual string parsing must be strictly used instead of raw object deserialization for error responses.

Deserialization of Untrusted Data: Uncontrolled Hessian2 deserialization permits arbitrary class instantiation. A robust, continually updated class factory deny list/allow list is required to block known gadget chains.

Auth Bypass: Non-uniform extraction of attachment parameters (e.g., host IP) allows attackers to bypass local-IP administrative restrictions by manipulating raw request attachments. Developers must use the standardized lookup API.