weibocom / motan

A cross-language remote procedure call(RPC) framework for rapid development of high performance distributed services.
Other
5.88k stars 1.78k forks source link

RCE Vulnerability #1033

Closed gfast777-sec closed 1 year ago

gfast777-sec commented 1 year ago

Problem Description

Motan utilizes the native Hessian protocol as part of its RPC communication. After conducting an in-depth analysis of Motan, we have identified a security issue, wherein attackers can potentially achieve Remote Command Execution (RCE) attacks by crafting carefully constructed payloads.

Reproduce

The Server Side